REST API overview.

The Reward Loyalty REST API is the session-token API: a client signs in as an admin, partner, staff member, or member, receives a Bearer token, and calls endpoints as that user. Use it for custom frontends, mobile apps, and third-party integrations. The Agent API is its machine-to-machine counterpart: long-lived keys instead of login sessions, built for POS systems, AI agents, and automation.

💡 Looking for the Agent API? If you need machine-to-machine access for POS systems, AI agents, or automation tools, see the Agent API documentation. The Agent API uses long-lived API keys instead of login tokens and targets automated systems.

API notice

ℹ️ Reward Loyalty works as a standalone platform with a complete web interface for all users. The API exists as a supplementary resource for developers who want to build custom integrations. We do not develop or support it beyond what ships with each release.

What this means for you:

• Standalone-first. All platform features are accessible through the web interface without any API integration.
• Developer foundation. The API provides working endpoints that experienced developers can extend and customize for their specific needs.
• Limited support scope. API-related issues fall outside our standard support. Development resources are required to maintain your integrations.
• Review before purchasing. Check the interactive API documentation to verify available endpoints meet your requirements. The Agent API documentation is also available for machine-to-machine integrations.

Interactive documentation

REST API (this API)

Full API documentation with request/response examples is available at:

https://your-domain.com/api/documentation

Browse the live REST API docs →

This Swagger UI interface lets you:

• Browse all available endpoints
• View request/response schemas
• Test endpoints from the browser (with authentication)

Agent API

The Agent API has its own dedicated OpenAPI specification:

Base URL

All API requests use your installation's domain:

https://your-domain.com/api/{locale}/v1

The {locale} parameter sets the response language for messages and validation errors (e.g., en-us, de-de). An unknown or inactive locale falls back to the installation default.

Authentication

Most endpoints require Bearer token authentication via Laravel Sanctum:

Authorization: Bearer your-api-token

Obtaining tokens

Obtain a token by calling the login endpoint for each user type:

Available endpoints

Admin endpoints

• Authentication: login, logout, profile
• Partner Management: list, get, create, update, delete
• Partner Permissions: get, update (for SaaS billing)
• Partner Usage: get usage vs limits

Partner endpoints

• Authentication: login, logout, profile, update
• Clubs: list, get, create, update, delete
• Loyalty cards: list, get, create, update, delete
• Stamp cards: list, get, create, update, delete
• Staff Members: list, get, create, update, delete
• Members: list, get, create, update, delete
• Vouchers: list, get, create, update, delete
• Prepaid Passes: list, get, create, update, delete
• Rewards: list, get, create, update, delete
• Transactions: add purchases, add points, deduct points
• Shopify Integration: get status, update settings, pause, resume, disconnect

Staff endpoints

• Authentication: login, logout, profile
• Member Lookup: find by identifier
• Loyalty Operations: add purchase, redeem reward
• Stamp Operations: add stamps, redeem stamp reward
• Voucher Operations: validate code, redeem voucher
• Pass Operations: list a member's passes, sell, use, undo

Member endpoints

• Authentication: register, login, logout, profile
• Anonymous Sessions (public, no token): init a device-bound member, read the session, switch devices with the short device code, link an email
• Loyalty cards: list all, followed, transacted, balance
• Stamp cards: list enrolled, history, enroll (add to My Cards), unenroll (remove)
• Vouchers: list saved, save (add to My Cards), unsave (remove)
• Prepaid Passes: list held passes, pass detail (read-only)

Email consent on member create and update. Members carry two email preferences: accepts_loyalty_emails (loyalty updates, defaults to true) and accepts_emails (offers and news, marketing). Passing accepts_emails: true asserts that you hold valid marketing consent from the member. On create, omitting it means false; on update, omitting it leaves the stored preference unchanged. The operator remains responsible for the consent rules in their jurisdiction.

Response format

All responses are JSON:

{
  "data": {
    // Response data
  }
}

Error responses include details:

{
  "message": "Error description",
  "errors": {
    "field": ["Validation error"]
  }
}

Rate limiting

The platform rate-limits API requests to prevent abuse. If you exceed limits, the server returns HTTP 429.

Extending the API

As a source code license holder, you can extend the API:

1. Create controllers in app/Http/Controllers/Api/
2. Add routes in routes/api.php
3. Add OpenAPI annotations for documentation
4. Run php artisan l5-swagger:generate to update docs

For guidance, refer to Laravel's official documentation and the existing API controllers as examples.

What's not included

The following features may require custom development:

• Tier management endpoints
• Referral code endpoints
• Email campaign management
• Analytics/reporting endpoints
• Webhook management

These features are available through the web interface and you can expose them via API by extending the existing controllers.