openapi: 3.0.3
info:
title: Admin Account / Address Configuration API
contact:
name: Spree Commerce
url: https://spreecommerce.org
email: hello@spreecommerce.org
description: "Spree Admin API v3 - Administrative API for managing products, orders, and store settings.\n\n## Authentication\n\nThe Admin API requires a secret API key passed in the `x-spree-api-key` header.\nSecret API keys can be generated in the Spree admin dashboard.\n\n## Response Format\n\nAll responses are JSON. List endpoints return paginated responses with `data` and `meta` keys.\nSingle resource endpoints return a flat JSON object.\n\n## Resource IDs\n\nEvery resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`,\n`variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths,\nrequest bodies, and Ransack filters all accept them directly.\n\n## Error Handling\n\nErrors return a consistent format:\n```json\n{\n \"error\": {\n \"code\": \"validation_error\",\n \"message\": \"Validation failed\",\n \"details\": { \"name\": [\"can't be blank\"] }\n }\n}\n```\n"
version: v3
servers:
- url: http://{defaultHost}
variables:
defaultHost:
default: localhost:3000
tags:
- name: Configuration
description: Store configuration — payment methods, tag autocomplete
paths:
/api/v3/admin/admin_users:
get:
summary: List staff
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns admin users with at least one role assignment on the current store.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: staff } = await client.adminUsers.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: staff found
content:
application/json:
example:
data:
- id: admin_UkLWZg9DAJ
email: angelic@oconnell.us
first_name: Jamal
last_name: Doyle
full_name: Jamal Doyle
created_at: '2026-05-24T17:36:33.885Z'
updated_at: '2026-05-24T17:36:33.885Z'
roles:
- id: role_UkLWZg9DAJ
name: admin
meta:
page: 1
limit: 25
count: 1
pages: 1
from: 1
to: 1
in: 1
previous: null
next: null
/api/v3/admin/admin_users/{id}:
get:
summary: Show a staff member
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst staff = await client.adminUsers.get('admin_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: staff member found
content:
application/json:
example:
id: admin_UkLWZg9DAJ
email: jess_king@rau.info
first_name: Mercedez
last_name: Bailey
full_name: Mercedez Bailey
created_at: '2026-05-24T17:36:34.235Z'
updated_at: '2026-05-24T17:36:34.235Z'
roles:
- id: role_UkLWZg9DAJ
name: admin
patch:
summary: Update a staff member
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Updates name fields and reassigns roles for the current store. `role_ids` is a complete replacement — roles not in the array are removed for this store.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst staff = await client.adminUsers.update('admin_xxx', {\n first_name: 'Ada',\n role_ids: ['role_xxx']\n})"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: staff member updated
content:
application/json:
example:
id: admin_UkLWZg9DAJ
email: joesph@grahammarks.ca
first_name: Renamed
last_name: Lindgren
full_name: Renamed Lindgren
created_at: '2026-05-24T17:36:34.526Z'
updated_at: '2026-05-24T17:36:34.545Z'
roles:
- id: role_UkLWZg9DAJ
name: admin
requestBody:
content:
application/json:
schema:
type: object
properties:
first_name:
type: string
example: Ada
last_name:
type: string
example: Lovelace
role_ids:
type: array
items:
type: string
delete:
summary: Remove a staff member from this store
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Removes the user''s role assignments on the current store. The account is preserved — the user keeps access to any other stores.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nawait client.adminUsers.delete('admin_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'204':
description: staff removed from store
/api/v3/admin/api_keys:
get:
summary: List API keys
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns publishable and secret API keys for the current store. Secret keys are listed by `token_prefix` only — the plaintext token is delivered exactly once on create.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: keys } = await client.apiKeys.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: API keys found
content:
application/json:
example:
data:
- id: key_UkLWZg9DAJ
name: Storefront key
key_type: publishable
token_prefix: null
scopes: []
created_at: '2026-05-24T17:36:34.854Z'
updated_at: '2026-05-24T17:36:34.854Z'
revoked_at: null
last_used_at: null
plaintext_token: pk_wqTPmhFDQiJbhbgokeP9tPzK
created_by_email: null
- id: key_gbHJdmfrXB
name: Backend integration
key_type: secret
token_prefix: sk_GAnG4mX7L
scopes:
- write_all
created_at: '2026-05-24T17:36:34.855Z'
updated_at: '2026-05-24T17:36:34.855Z'
revoked_at: null
last_used_at: null
plaintext_token: null
created_by_email: null
- id: key_EfhxLZ9ck8
name: occaecati
key_type: secret
token_prefix: sk_Zf75n9zm3
scopes:
- write_all
created_at: '2026-05-24T17:36:34.857Z'
updated_at: '2026-05-24T17:36:34.857Z'
revoked_at: null
last_used_at: null
plaintext_token: null
created_by_email: null
meta:
page: 1
limit: 25
count: 3
pages: 1
from: 1
to: 3
in: 3
previous: null
next: null
post:
summary: Create an API key
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Creates a publishable or secret API key. The plaintext token is included in the response **once** for secret keys; publishable keys expose their token on every read since they are intended for client-side use.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.create({\n name: 'Backend integration',\n key_type: 'secret',\n scopes: ['read_orders', 'write_orders']\n})\n// `key.plaintext_token` is available only on this response."
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'201':
description: secret key created — plaintext token returned once
content:
application/json:
example:
id: key_VqXmZF31wY
name: CI key
key_type: secret
token_prefix: sk_ryCceerpp
scopes:
- read_orders
created_at: '2026-05-24T17:36:35.441Z'
updated_at: '2026-05-24T17:36:35.441Z'
revoked_at: null
last_used_at: null
plaintext_token: sk_ryCceerpp5vqodztxueeWXmc
created_by_email: opal.herzog@cremin.info
'422':
description: validation error
content:
application/json:
example:
error:
code: validation_error
message: Name can't be blank and Scopes can't be blank
details:
name:
- can't be blank
scopes:
- can't be blank
requestBody:
content:
application/json:
schema:
type: object
required:
- name
- key_type
properties:
name:
type: string
example: Backend integration
key_type:
type: string
enum:
- publishable
- secret
scopes:
type: array
items:
type: string
example:
- read_orders
- write_orders
/api/v3/admin/api_keys/{id}:
get:
summary: Show an API key
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.get('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: API key found
content:
application/json:
example:
id: key_UkLWZg9DAJ
name: Storefront key
key_type: publishable
token_prefix: null
scopes: []
created_at: '2026-05-24T17:36:35.723Z'
updated_at: '2026-05-24T17:36:35.723Z'
revoked_at: null
last_used_at: null
plaintext_token: pk_yXJtU7SvnfLbkPvuuiUnKaEo
created_by_email: null
delete:
summary: Delete an API key
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nawait client.apiKeys.delete('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'204':
description: API key deleted
/api/v3/admin/api_keys/{id}/revoke:
patch:
summary: Revoke an API key
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Marks the key revoked. Future requests using its token will fail; the row is preserved for audit.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.revoke('key_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: API key revoked
content:
application/json:
example:
id: key_gbHJdmfrXB
name: Backend integration
key_type: secret
token_prefix: sk_q6euaWxod
scopes:
- write_all
created_at: '2026-05-24T17:36:36.279Z'
updated_at: '2026-05-24T17:36:36.554Z'
revoked_at: '2026-05-24T17:36:36.553Z'
last_used_at: null
plaintext_token: null
created_by_email: null
/api/v3/admin/invitations:
get:
summary: List invitations
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns invitations for the current store, including pending and accepted.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: invitations } = await client.invitations.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: invitations found
content:
application/json:
example:
data:
- id: inv_UkLWZg9DAJ
email: eva@hauckwisozk.info
status: pending
created_at: '2026-05-24T17:37:01.802Z'
updated_at: '2026-05-24T17:37:01.802Z'
expires_at: '2026-06-07T17:37:01.798Z'
role_id: role_UkLWZg9DAJ
role_name: admin
inviter_email: faith@moore.info
acceptance_url: /accept-invitation/inv_UkLWZg9DAJ?token=zySacMBFavnzmtA9ZV4NQdhg
invitee_exists: false
store:
id: store_UkLWZg9DAJ
name: Spree Test Store
meta:
page: 1
limit: 25
count: 1
pages: 1
from: 1
to: 1
in: 1
previous: null
next: null
post:
summary: Create an invitation
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Invites a teammate by email. The invitation is scoped to the current store and carries the chosen role; on accept, a `RoleUser` is created via the invitation''s `after_accept` callback.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst invitation = await client.invitations.create({\n email: 'ada@example.com',\n role_id: 'role_xxx'\n})"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'201':
description: invitation created
content:
application/json:
example:
id: inv_gbHJdmfrXB
email: new-staff@example.com
status: pending
created_at: '2026-05-24T17:37:02.111Z'
updated_at: '2026-05-24T17:37:02.111Z'
expires_at: '2026-06-07T17:37:02.108Z'
role_id: role_UkLWZg9DAJ
role_name: admin
inviter_email: floy_cummerata@haleyvonrueden.com
acceptance_url: /accept-invitation/inv_gbHJdmfrXB?token=EzFbcPeHADJwGwapUkFjCjut
invitee_exists: false
store:
id: store_UkLWZg9DAJ
name: Spree Test Store
requestBody:
content:
application/json:
schema:
type: object
required:
- email
- role_id
properties:
email:
type: string
example: ada@example.com
role_id:
type: string
example: role_xxx
/api/v3/admin/invitations/{id}:
delete:
summary: Revoke an invitation
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: '**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nawait client.invitations.delete('inv_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'204':
description: invitation revoked
/api/v3/admin/invitations/{id}/resend:
patch:
summary: Resend an invitation
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Issues a fresh token and dispatches the invitation email again.
**Required scope:** `write_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst invitation = await client.invitations.resend('inv_xxx')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
responses:
'200':
description: invitation resent
content:
application/json:
example:
id: inv_UkLWZg9DAJ
email: bao.grant@johnsonwitting.com
status: pending
created_at: '2026-05-24T17:37:02.736Z'
updated_at: '2026-05-24T17:37:02.736Z'
expires_at: '2026-06-07T17:37:02.733Z'
role_id: role_UkLWZg9DAJ
role_name: admin
inviter_email: merlene_cormier@hanepredovic.info
acceptance_url: /accept-invitation/inv_UkLWZg9DAJ?token=KRTKCjz8LLoWUjxZrWFrAzKU
invitee_exists: false
store:
id: store_UkLWZg9DAJ
name: Spree Test Store
/api/v3/admin/payment_methods:
get:
summary: List payment methods
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns the store''s configured payment methods. Use `source_required: true` to know which methods need a saved source.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: paymentMethods } = await client.paymentMethods.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: expand
in: query
required: false
description: Comma-separated associations to expand. Use dot notation for nested expand (max 4 levels).
schema:
type: string
- name: fields
in: query
required: false
description: Comma-separated list of fields to include (e.g., name,type,active). id is always included.
schema:
type: string
responses:
'200':
description: payment methods found
content:
application/json:
example:
data:
- id: pm_UkLWZg9DAJ
name: Check
description: null
type: check
session_required: false
source_required: false
metadata: {}
active: true
auto_capture: null
storefront_visible: true
position: 1
created_at: '2026-05-24T17:37:31.151Z'
updated_at: '2026-05-24T17:37:31.153Z'
preferences: {}
preference_schema: []
meta:
page: 1
limit: 25
count: 1
pages: 1
from: 1
to: 1
in: 1
previous: null
next: null
/api/v3/admin/payment_methods/types:
get:
summary: List available payment provider types
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns the registered Spree::PaymentMethod subclasses that can be used to create new payment methods. Useful for populating a "Provider" dropdown in admin UIs.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: types } = await client.paymentMethods.types()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: provider types found
content:
application/json:
example:
data:
- type: bogus
label: Bogus
description: null
preference_schema:
- key: dummy_key
type: string
default: PUBLICKEY123
- key: dummy_secret_key
type: password
default: null
- type: custom_payment_source_method
label: Custom Payment Source Method
description: null
preference_schema: []
/api/v3/admin/payment_methods/{id}:
get:
summary: Show a payment method
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns a payment method by ID.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst paymentMethod = await client.paymentMethods.get('pm_UkLWZg9DAJ')"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
- name: id
in: path
required: true
schema:
type: string
- name: expand
in: query
required: false
description: Comma-separated associations to expand. Use dot notation for nested expand (max 4 levels).
schema:
type: string
- name: fields
in: query
required: false
description: Comma-separated list of fields to include (e.g., name,type,active). id is always included.
schema:
type: string
responses:
'200':
description: payment method found
content:
application/json:
example:
id: pm_UkLWZg9DAJ
name: Check
description: null
type: check
session_required: false
source_required: false
metadata: {}
active: true
auto_capture: null
storefront_visible: true
position: 1
created_at: '2026-05-24T17:37:31.752Z'
updated_at: '2026-05-24T17:37:31.754Z'
preferences: {}
preference_schema: []
/api/v3/admin/roles:
get:
summary: List roles
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns the roles available for staff role pickers. Roles are global, not per-store.
**Required scope:** `read_settings` (for API-key authentication).'
x-codeSamples:
- lang: javascript
label: Spree Admin SDK
source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n baseUrl: 'https://your-store.com',\n secretKey: 'sk_xxx',\n})\n\nconst { data: roles } = await client.roles.list()"
parameters:
- name: x-spree-api-key
in: header
required: true
schema:
type: string
- name: Authorization
in: header
required: true
schema:
type: string
responses:
'200':
description: roles found
content:
application/json:
example:
data:
- id: role_UkLWZg9DAJ
name: admin
created_at: '2026-05-24T17:37:45.227Z'
updated_at: '2026-05-24T17:37:45.227Z'
meta:
page: 1
limit: 25
count: 1
pages: 1
from: 1
to: 1
in: 1
previous: null
next: null
/api/v3/admin/stock_locations:
get:
summary: List stock locations
tags:
- Configuration
security:
- api_key: []
bearer_auth: []
description: 'Returns the configured stock locations. Stock locations are global
(shared across stores). Filter with Ransack predicates such as
`q[active_eq]`, `q[kind_eq]`, `q[pickup_enabled_eq]`, or
`q[name_cont]`.
Pickup-related attributes (`kind`, `pickup_enabled`,
`pickup_stock_policy`, `pickup_ready_in_minutes`,
`pickup_instructions`) drive merchant pickup support at checkout —
customers can collect orders from any active location with
# --- truncated at 32 KB (68 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/spree-commerce/refs/heads/main/openapi/spree-commerce-configuration-api-openapi.yml