Get loyalty program configuration
Retrieves the shop's active loyalty campaign configuration: its tiers (ordered by starting points) and milestones (ordered by points needed). Returns NOT_FOUND when the shop has no active loyalty campaign.
Authorization
hmac Versioned HMAC-SHA256 signature authenticating server-to-server SDK requests (your backend calling Stash), as opposed to client-side SDK operations. Recommended over the deprecated X-Stash-Api-Key for the best security. Header format: v1;{appId};{unixMillisTimestamp};{base64Signature} (semicolon-delimited). {base64Signature} is the base64-encoded HMAC-SHA256 of the string {unixMillisTimestamp}.{requestBody} using your app ingress secret (the ingress secret is shown base64-encoded in Studio; base64-decode it to the raw bytes used as the HMAC key), where {requestBody} is the request body exactly as you send it for POST and PUT requests (the compact canonical request JSON is also accepted) and empty for GET requests. A signature over the exact bytes verifies for bodies of up to 18 KiB (18,432 bytes); a larger body may be refused with 401 even when correctly signed. The timestamp must be within 5 minutes of Stash server time. Your appId is your immutable app identifier, shown in Stash Studio under Project Settings > App details; your ingress secret is under Project Settings > API Secrets.
In: header
Path Parameters
Shop identifier from Stash Studio
Response Body
application/json
application/json
curl -X GET "https://example.com/sdk/studio/string/loyalty"{ "activeCampaign": { "campaignId": "string", "tiers": [ { "tierId": "string", "name": "string", "startPoints": 0, "pointsPerDollar": 0, "pointsMultiplierPermille": 0, "iconUrl": "string", "milestones": [ { "milestoneId": "string", "name": "string", "pointsNeeded": 0, "rewards": [ { "itemId": "string", "quantity": 0, "type": "LOYALTY_REWARD_TYPE_UNSPECIFIED" } ] } ] } ] }}How is this guide?
Refresh localizations POST
Asks Stash to refresh the shop's localizations from its enabled localization source, for example after the source file changes. The request body is the empty JSON object {}. This method accepts only the versioned x-stash-hmac-signature header, signed over the request body exactly as sent ({}); the legacy stash-hmac-signature header is rejected with UNAUTHENTICATED, because it carries no timestamp and a captured request could be replayed. The shop in the signature header must equal the shop_id in the path. A successful response means the refresh is durably queued, not that the import has completed or that the storefront shows the result. Repeated calls are safe, so retry after UNAVAILABLE or a timeout with a fresh timestamp and signature. Returns UNAUTHENTICATED when the signature is missing, invalid, outside the time window, sent in the legacy header, or names a different shop or one Stash does not know; FAILED_PRECONDITION when the shop has no enabled localization source; and UNAVAILABLE when the refresh could not be queued, in which case retry.
Get loyalty configuration GET
Retrieves the shop's loyalty configuration in the shape UpdateLoyaltyConfig accepts: display settings, bonus definitions, reward products with their status, and every campaign (season) with its status. Product rewards are returned by SKU. Use it to verify a sync. Returns NOT_FOUND when the shop has no loyalty program.