Two different signup flows are supported:

1. Storebox controlled term accept
2. Customer controlled term accept

In Storebox controlled term accept, the link sent in the verification SMS sends the enduser to a generic term accept page controlled by Storebox. This page contains an IFrame and an "Accept" button. The IFrame will load an external webpage, which must be provided, containing the terms of the loyalty program. Upon Accept, the enduser will be redirected to the landingpage:

In Customer controlled term accept, the verification SMS link sends the enduser directly to an external signup page. The link contains a linkCode. When the enduser has entered all mandatory profile information and accepted the terms, the signup service can call Storebox with the linkCode. Storebox will then create the user.

Call linkcode exists endpoint to ensure the linkCode exists before the user starts to enter signup information.

When users have accepted the terms call linkcode verify to create the user

User CRUD operations. If used from a hostile environment using bearer token authentication the header X-Storebox-user-token is required with the token from the authentication process (See User Authentication).

OTP validation

If the API is used as client-to-server API, the user operation requires an authentication token. This token has to be present as a header X-Storebox-user-token, when requesting user operations (/users)

The landing page is a HTML page hosted externally for acquiring user consent.

The landing page is requested with a linkCode parameter ex.:

https://domain.tld/landingpage?linkCode={value}

This linkCode is used to finalize the creation process after consent has been given.

A description of the flow can be found in Customer controlled term accept under Signup.

For security reasons the linkCode is deleted after the request has been completed and cannot be used to update user information again.

When certain events happen within the user platform, a notification can be dispatched.

In order to setup notications, Storebox must receive an URL per notification type with static authentication headers. Storebox will not append information of the event type to the URL.

Storebox monitors the response code returned, but will not handle the response body.

Note: None of the endpoints, in the "Notifications" section, exists in the user API, but are endpoints the integrator must implement and expose. The suggested URL's, are only examples, and you, as an integrator, are free to define your own.