Set maintenance mode
Switches your web shop into or out of maintenance mode. While it is on, players see the web shop's maintenance screen instead of the shop: new visits and sign-ins get the maintenance screen once the setting reaches the web shop, normally within about 30 seconds. A page a player already has open switches to the maintenance screen when it next reloads. Players stay signed in. Send enabled true to switch it on and false to switch it off; a request without enabled is refused with 400. The call is idempotent: switching on a shop that is already in maintenance mode succeeds and keeps the original since time, and switching off a shop that is not in maintenance mode succeeds and changes nothing. The response returns the resulting state. Each shop may make up to 10 calls every 60 seconds; above that it returns 429 with a RetryInfo detail giving how long to wait. This is a server-side endpoint and should not be called from the client.
Authorization
hmac Versioned HMAC-SHA256 signature authenticating server-to-server SDK requests (your backend calling Stash), as opposed to client-side SDK operations. Recommended over the deprecated X-Stash-Api-Key for the best security. Header format: v1;{appId};{unixMillisTimestamp};{base64Signature} (semicolon-delimited). {base64Signature} is the base64-encoded HMAC-SHA256 of the string {unixMillisTimestamp}.{requestBody} using your app ingress secret (the ingress secret is shown base64-encoded in Studio; base64-decode it to the raw bytes used as the HMAC key), where {requestBody} is the request body exactly as you send it for POST and PUT requests (the compact canonical request JSON is also accepted) and empty for GET requests. A signature over the exact bytes verifies for bodies of up to 18 KiB (18,432 bytes); a larger body may be refused with 401 even when correctly signed. The timestamp must be within 5 minutes of Stash server time. Your appId is your immutable app identifier, shown in Stash Studio under Project Settings > App details; your ingress secret is under Project Settings > API Secrets.
In: header
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/sdk/server/shop/maintenance" \ -H "Content-Type: application/json" \ -d '{ "enabled": true }'{ "enabled": true, "since": "2019-08-24T14:15:22Z"}How is this guide?
Get maintenance mode GET
Returns whether your web shop is in maintenance mode and, while it is, since when. Each shop may make up to 60 calls every 60 seconds; above that it returns 429 with a RetryInfo detail giving how long to wait. This is a server-side endpoint and should not be called from the client.
Approve custom login POST
Approves a pending webshop login from your game server. Send the login code the webshop passed to your game, through the login deep link or a QR code, together with the signed-in player as user; Stash then completes the webshop login as that player. Authenticate the request with an HMAC signature of the request body, or with the deprecated API key. This is a server-side endpoint and must not be called from the game client.