# GoGift

> GoGift sells and distributes digital gift cards and rewards globally. Its REST API lets a
> business filter a multi-thousand-brand gift-card catalogue, build a basket of gift cards for
> named recipients, and finalize it into a paid order that GoGift fulfils by email, SMS, CSV,
> webhook or physical post. The API is HTTPS-only, JSON-only, unversioned, and authenticated
> with OpenID Connect client credentials.

Generated by API Evangelist on 2026-09-12 from GoGift's public documentation and live discovery
documents. GoGift does not publish an llms.txt of its own (https://docs.gogift.io/llms.txt and
https://global.gogift.com/llms.txt both return 404). This file is an independent third-party
summary, not a GoGift publication.

## Key facts

- Production API base: https://api.gogift.io
- Production authorization server: https://auth.gogift.io
- Sandbox API base: https://api-pre.gogift.io
- Sandbox authorization server: https://auth-pre.gogift.io
- Auth: OpenID Connect, client_credentials grant, JWT bearer token (RS256)
- Credentials are issued by GoGift; there is no self-service API signup
- No OpenAPI, no GraphQL, no MCP server, no A2A agent card, no SDK on any package registry
- No published rate limits, no status page, no changelog, no SLA

## Documentation

- [API reference](https://docs.gogift.io/): single-page reference covering authentication, content types, idempotency, pagination, the five REST operations, and the delivery-fulfilment webhook
- [Gift card API overview](https://global.gogift.com/en/gift-card-api): product page for the API
- [Production OpenID Connect discovery](https://auth.gogift.io/.well-known/openid-configuration): live JSON, lists endpoints, grants, scopes and claims
- [Sandbox OpenID Connect discovery](https://auth-pre.gogift.io/.well-known/openid-configuration): live JSON
- [Support centre](https://support.gogift.com/en): help articles, including terms and privacy
- [Pricing](https://global.gogift.com/en/pricing): no tiers published; you pay the face value of the rewards you send

## Operations

- `POST|GET /products/filter` — filter the catalogue by sales channel, delivery method and redeemable-in countries. Paginated (`paging` in, `pagingInfo` out, default 50 per page).
- `GET /products/{id}` — one product with its delivery methods and inventory entries (SKUs). The only source of prices.
- `POST /baskets` — create a basket against a sales channel. NOT idempotent.
- `PUT /baskets` — set the buyer, deliveries, recipients and product lines. Supports `Idempotency-Key`.
- `POST /baskets/finalize` — commit the basket with a payment method (`InvoiceByFinance`, `ExternalPsp`, `Trustly`). Supports `Idempotency-Key`. Returns `nextStep`, `paymentWindowUrl`, `orderId`, `publicOrderId`.

## Events

- One outbound webhook: delivery fulfilment. GoGift POSTs to the `recipientWebhookUrl` set on a delivery, with a `Signature` header (hmac-sha256, draft-cavage HTTP Signatures style) validated using a GoGift-issued ClientId and WebhookSecret. The payload carries `giftcardUri` and `pin` — treat it as a secret.

## Conventions an agent must know

- Idempotency is PARTIAL. `Idempotency-Key` is honoured on `PUT /baskets` and `POST /baskets/finalize` only, with a one-week retention window. The body must not change across replays of a key or the request fails with `ArgumentException`. Basket creation is not covered — a retried create makes a second basket.
- Reversibility: NONE is documented. There is no cancel, refund, void or reverse operation in the published reference. `redirectConfig.cancelUrl` is a browser return URL for a human abandoning the payment window before payment, not an API reversal.
- Errors come back in a `responseStatus` envelope inside the response body (`errorCode`, `message`, `stackTrace`, `errors[]`, `meta`), not as RFC 9457 problem+json. GoGift publishes no error-code reference.
- Dates are ISO 8601 UTC (`YYYY-MM-DDThh:mm:ssZ`). Countries are ISO 3166 Alpha-2, currencies ISO 4217, languages ISO 639.
- Localized fields are maps keyed by language code with `null` for untranslated languages.
- Do not hardcode product ids, SKUs or prices — GoGift states the catalogue changes and that seasonal products, tickets, experiences and micro gifts are repriced at least annually.
- Breaking changes are communicated by direct notification to integrators. There is no version in the URL and no changelog to watch.

## Artifacts in this profile

- authentication/gogift-authentication.yml — OpenID Connect profile, flows, endpoints, webhook signing
- scopes/gogift-scopes.yml — the 11 scopes advertised by the authorization server
- conventions/gogift-conventions.yml — idempotency coverage, reversibility, pagination, error envelope, versioning
- errors/gogift-problem-types.yml — the error envelope and the one documented error
- asyncapi/gogift-webhooks.yml — the delivery-fulfilment webhook catalog
- data-model/gogift-data-model.yml — 16 entities and the relationships between them
- conformance/gogift-conformance.yml — 23 standards checked, with evidence
- sandbox/gogift-sandbox.yml — the Pre environment
- lifecycle/gogift-lifecycle.yml — change policy and the gaps (no changelog, no status page, no SLA)
- rate-limits/gogift-rate-limits.yml — none published
- plans/gogift-plans-pricing.yml — no tiers published
- packages/gogift-packages.yml — no first-party SDK on any registry
- mcp/gogift-mcp.yml — candidate tool mapping; GoGift ships no MCP server
- well-known/gogift-well-known.yml — the discovery probe across every host
- security/gogift-domain-security.yml — TLS, HSTS, DNSSEC, SPF, DMARC

## Not available

- OpenAPI / Swagger: none published. Probed /openapi.json, /openapi.yaml, /swagger.json, /swagger/v1/swagger.json, /v1/openapi.json, /api-docs, /swagger, /docs and /redoc on api.gogift.io, api-pre.gogift.io, auth.gogift.io, auth-pre.gogift.io and docs.gogift.io — all 404.
- AsyncAPI, GraphQL, gRPC/Protobuf, WSDL: none.
- MCP server, A2A agent card, ai-plugin.json, api-catalog, security.txt: none served on any GoGift host.
- Postman collection or workspace: none public.
- Official SDK or CLI: none on npm, PyPI, NuGet, Maven Central, RubyGems, Packagist or crates.io.