Customers

The Customers resource lives at /api/v1/customer and requires the customers permission. Responses use the standard envelope.

Endpoints

Method	Path	Purpose
GET	/api/v1/customer	List customers (paginated).
GET	/api/v1/customer/:id	Read one customer.
GET	/api/v1/customer/:id/orders	That customer’s orders.
GET	/api/v1/customer/:id/stats	Lifetime totals for the customer.
POST	/api/v1/customer	Create a customer.
DELETE	/api/v1/customer/:id	Deactivate (soft) a customer.

List response

The list carries a stats summary alongside the rows and pagination:

{
  "success": true,
  "message": "Customers fetched successfully",
  "data": {
    "customers": [ /* customer objects */ ],
    "stats": { "total": 1240, "active": 1190, "verified": 900 },
    "pagination": { "page": 1, "limit": 20, "total": 1240, "pages": 62 }
  }
}

The customer object

Field	Type	Notes
id	string (UUID)
email	string	Unique per store.
firstName / lastName	string
phone	string | null
avatar	string | null
isGuest	boolean	Created at guest checkout.
isActive	boolean
isEmailVerified	boolean
marketingOptIn	boolean	Consent to marketing.
createdAt / updatedAt	datetime

Secrets (password hashes, verification/reset codes, lockout counters) are never returned — the API strips them from every response.

Create

POST /api/v1/customer
{
  "email": "sam@example.com",
  "firstName": "Sam",
  "lastName": "Lee",
  "phone": "+201234567890"
}

On admin creation the response may include a one-time verificationCode and/or a temporaryPassword — shown once, so capture them if you need them.