openapi: 3.0.3
info:
  title: Admin Account / Address API Keys API
  contact:
    name: Spree Commerce
    url: https://spreecommerce.org
    email: hello@spreecommerce.org
  description: "Spree Admin API v3 - Administrative API for managing products, orders, and store settings.\n\n## Authentication\n\nThe Admin API requires a secret API key passed in the `x-spree-api-key` header.\nSecret API keys can be generated in the Spree admin dashboard.\n\n## Response Format\n\nAll responses are JSON. List endpoints return paginated responses with `data` and `meta` keys.\nSingle resource endpoints return a flat JSON object.\n\n## Resource IDs\n\nEvery resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`,\n`variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths,\nrequest bodies, and Ransack filters all accept them directly.\n\n## Error Handling\n\nErrors return a consistent format:\n```json\n{\n  \"error\": {\n    \"code\": \"validation_error\",\n    \"message\": \"Validation failed\",\n    \"details\": { \"name\": [\"can't be blank\"] }\n  }\n}\n```\n"
  version: v3
servers:
- url: http://{defaultHost}
  variables:
    defaultHost:
      default: localhost:3000
tags:
- name: API Keys
  description: Secret and publishable API keys
paths:
  /api/v3/admin/api_keys:
    get:
      summary: List API keys
      tags:
      - API Keys
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns publishable and secret API keys for the current store. Secret keys are listed by `token_prefix` only — the plaintext token is delivered exactly once on create.


        **Required scope:** `read_api_keys` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: keys } = await client.apiKeys.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API keys found
          content:
            application/json:
              example:
                data:
                - id: key_UkLWZg9DAJ
                  name: Storefront key
                  key_type: publishable
                  token_prefix: null
                  scopes: []
                  created_at: '2026-06-12T17:23:45.015Z'
                  updated_at: '2026-06-12T17:23:45.015Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: pk_5AskmHCv2omYyoBr3mehREcX
                  created_by_email: null
                - id: key_gbHJdmfrXB
                  name: Backend integration
                  key_type: secret
                  token_prefix: sk_qBGxwGooh
                  scopes:
                  - write_all
                  created_at: '2026-06-12T17:23:45.016Z'
                  updated_at: '2026-06-12T17:23:45.016Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: null
                  created_by_email: null
                - id: key_EfhxLZ9ck8
                  name: minima
                  key_type: secret
                  token_prefix: sk_2bVt6n2wq
                  scopes:
                  - write_all
                  created_at: '2026-06-12T17:23:45.017Z'
                  updated_at: '2026-06-12T17:23:45.017Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: null
                  created_by_email: null
                meta:
                  page: 1
                  limit: 25
                  count: 3
                  pages: 1
                  from: 1
                  to: 3
                  in: 3
                  previous: null
                  next: null
    post:
      summary: Create an API key
      tags:
      - API Keys
      security:
      - api_key: []
        bearer_auth: []
      description: 'Creates a publishable or secret API key. The plaintext token is included in the response **once** for secret keys; publishable keys expose their token on every read since they are intended for client-side use.


        **Required scope:** `write_api_keys` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.create({\n  name: 'Backend integration',\n  key_type: 'secret',\n  scopes: ['read_orders', 'write_orders']\n})\n// `key.plaintext_token` is available only on this response."
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '201':
          description: secret key created — plaintext token returned once
          content:
            application/json:
              example:
                id: key_VqXmZF31wY
                name: CI key
                key_type: secret
                token_prefix: sk_vGdftBeFe
                scopes:
                - read_orders
                created_at: '2026-06-12T17:23:45.625Z'
                updated_at: '2026-06-12T17:23:45.625Z'
                revoked_at: null
                last_used_at: null
                plaintext_token: sk_vGdftBeFecVvHg1towF93knP
                created_by_email: dirk_morar@ohara.info
        '422':
          description: validation error
          content:
            application/json:
              example:
                error:
                  code: validation_error
                  message: Name can't be blank and Scopes can't be blank
                  details:
                    name:
                    - can't be blank
                    scopes:
                    - can't be blank
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - key_type
              properties:
                name:
                  type: string
                  example: Backend integration
                key_type:
                  type: string
                  enum:
                  - publishable
                  - secret
                scopes:
                  type: array
                  items:
                    type: string
                  example:
                  - read_orders
                  - write_orders
  /api/v3/admin/api_keys/{id}:
    get:
      summary: Show an API key
      tags:
      - API Keys
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `read_api_keys` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.get('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API key found
          content:
            application/json:
              example:
                id: key_UkLWZg9DAJ
                name: Storefront key
                key_type: publishable
                token_prefix: null
                scopes: []
                created_at: '2026-06-12T17:23:45.944Z'
                updated_at: '2026-06-12T17:23:45.944Z'
                revoked_at: null
                last_used_at: null
                plaintext_token: pk_bZ5pTDmsuFozzLiikk62bCgQ
                created_by_email: null
    delete:
      summary: Delete an API key
      tags:
      - API Keys
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `write_api_keys` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nawait client.apiKeys.delete('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: API key deleted
  /api/v3/admin/api_keys/{id}/revoke:
    patch:
      summary: Revoke an API key
      tags:
      - API Keys
      security:
      - api_key: []
        bearer_auth: []
      description: 'Marks the key revoked. Future requests using its token will fail; the row is preserved for audit.


        **Required scope:** `write_api_keys` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.revoke('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API key revoked
          content:
            application/json:
              example:
                id: key_gbHJdmfrXB
                name: Backend integration
                key_type: secret
                token_prefix: sk_PVNjbM3kV
                scopes:
                - write_all
                created_at: '2026-06-12T17:23:46.589Z'
                updated_at: '2026-06-12T17:23:47.008Z'
                revoked_at: '2026-06-12T17:23:47.006Z'
                last_used_at: null
                plaintext_token: null
                created_by_email: null
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: x-spree-api-key
      in: header
      description: Secret API key for admin access
    bearer_auth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT token for admin user authentication
x-tagGroups:
- name: Authentication
  tags:
  - Authentication
- name: Products & Catalog
  tags:
  - Products
  - Variants
  - Option Types
  - Custom Fields
  - Channels
- name: Pricing
  tags:
  - Pricing
  - Markets
- name: Orders & Fulfillment
  tags:
  - Orders
  - Payments
  - Fulfillments
  - Refunds
- name: Customers
  tags:
  - Customers
  - Customer Groups
- name: Promotions & Gift Cards
  tags:
  - Promotions
  - Gift Cards
- name: Data
  tags:
  - Exports
- name: Configuration
  tags:
  - Settings
  - Stock Locations
  - Payment Methods
  - Staff
  - API Keys
  - Allowed Origins
  - Webhooks