> For the complete documentation index, see [llms.txt](https://docs.spurtcommerce.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spurtcommerce.com/api-reference/vendor/authentication/vendor-account-and-authentication.md).

# Vendor Account And Authentication

Authenticate vendor users and manage account credentials and profile.

## Authenticate or process Demo  Login

> Post /api/demo-vendor/login\
> \
> \*\*Authentication:\*\* Login endpoint; no bearer token is sent.\
> \
> \*\*Feature area:\*\* Vendor Access & Login\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorDemoController.ts\`\
> \
> \*\*Request example provenance:\*\* Illustrative login body; confirm the legacy demo-login DTO before using this route. Prefer /api/demo-vendor/login-new when following the documented email/password flow.\
> \
> \*\*Response example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \> \*\*Example status: Illustrative.\*\* The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"paths":{"/api/demo-vendor/login":{"post":{"operationId":"postApiDemoVendorLogin","summary":"Authenticate or process Demo  Login","description":"Post /api/demo-vendor/login\n\n**Authentication:** Login endpoint; no bearer token is sent.\n\n**Feature area:** Vendor Access & Login\n\n**Implementation source:** `src/api/vendor/controllers/VendorDemoController.ts`\n\n**Request example provenance:** Illustrative login body; confirm the legacy demo-login DTO before using this route. Prefer /api/demo-vendor/login-new when following the documented email/password flow.\n\n**Response example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n> **Example status: Illustrative.** The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema. Example is illustrative and does not guarantee a stable response contract.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"status":{"type":"integer"}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Error response example. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}},"requestBody":{"required":false,"description":"Sample request body. Illustrative login body; confirm the legacy demo-login DTO before using this route. Prefer /api/demo-vendor/login-new when following the documented email/password flow. Treat this as an illustrative example, not a complete DTO contract.","content":{"application/json":{"schema":{"type":"object","properties":{"emailId":{"type":"string"},"password":{"type":"string","writeOnly":true}},"additionalProperties":true}}}}}}}}
```

## Authenticate or process Demo  Login New

> Post /api/demo-vendor/login-new\
> \
> \*\*Authentication:\*\* Login endpoint; no bearer token is sent.\
> \
> \*\*Feature area:\*\* Vendor Access & Login\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorDemoController.ts\`\
> \
> \*\*Request example provenance:\*\* Source-defined in VendorDemoController.\
> \
> \*\*Response example provenance:\*\* Exact API comment example.\
> \
> \> Example is based on the linked repository source. Replace example identifiers and credentials with values from your tenant.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"paths":{"/api/demo-vendor/login-new":{"post":{"operationId":"postApiDemoVendorLoginNew","summary":"Authenticate or process Demo  Login New","description":"Post /api/demo-vendor/login-new\n\n**Authentication:** Login endpoint; no bearer token is sent.\n\n**Feature area:** Vendor Access & Login\n\n**Implementation source:** `src/api/vendor/controllers/VendorDemoController.ts`\n\n**Request example provenance:** Source-defined in VendorDemoController.\n\n**Response example provenance:** Exact API comment example.\n\n> Example is based on the linked repository source. Replace example identifiers and credentials with values from your tenant.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Exact API comment example.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"object","properties":{"token":{"type":"string","writeOnly":true},"user":{"type":"object","properties":{"id":{"type":"integer"},"firstName":{"type":"string"},"email":{"type":"string"}},"additionalProperties":true},"permission":{"type":"object","properties":{},"additionalProperties":true}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Error response example. Exact API comment example.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}},"requestBody":{"required":true,"description":"Request body follows VerifyOtpRequest. Both emailId and password use @IsNotEmpty; emailId also uses @IsEmail.","content":{"application/json":{"schema":{"type":"object","properties":{"emailId":{"type":"string","format":"email","description":"Required vendor user email address."},"password":{"type":"string","format":"password","writeOnly":true,"description":"Required vendor user password."}},"additionalProperties":true,"required":["emailId","password"]}}}}}}}}
```

## Authenticate or process Demo  Send Otp

> Post /api/demo-vendor/send-otp\
> \
> \*\*Authentication:\*\* Login endpoint; no bearer token is sent.\
> \
> \*\*Feature area:\*\* Vendor Access & Login\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorDemoController.ts\`\
> \
> \*\*Request example provenance:\*\* Illustrative OTP request; verify the exact VendorDemoController DTO.\
> \
> \*\*Response example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \> \*\*Example status: Illustrative.\*\* The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"paths":{"/api/demo-vendor/send-otp":{"post":{"operationId":"postApiDemoVendorSendOtp","summary":"Authenticate or process Demo  Send Otp","description":"Post /api/demo-vendor/send-otp\n\n**Authentication:** Login endpoint; no bearer token is sent.\n\n**Feature area:** Vendor Access & Login\n\n**Implementation source:** `src/api/vendor/controllers/VendorDemoController.ts`\n\n**Request example provenance:** Illustrative OTP request; verify the exact VendorDemoController DTO.\n\n**Response example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n> **Example status: Illustrative.** The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema. Example is illustrative and does not guarantee a stable response contract.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"status":{"type":"integer"}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Error response example. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}},"requestBody":{"required":false,"description":"Sample request body. Illustrative OTP request; verify the exact VendorDemoController DTO. Treat this as an illustrative example, not a complete DTO contract.","content":{"application/json":{"schema":{"type":"object","properties":{"emailId":{"type":"string"}},"additionalProperties":true}}}}}}}}
```

## Update User Change Password

> Put /api/vendor-user/change-password\
> \
> \*\*Authentication:\*\* Vendor bearer token required for protected operations; verify exact permission decorator in controller.\
> \
> \*\*Feature area:\*\* Change Password\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorController.ts\`\
> \
> \*\*Request example provenance:\*\* Illustrative password-change body; verify exact DTO names and policy.\
> \
> \*\*Response example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \> \*\*Example status: Illustrative.\*\* The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Paste the JWT access token returned by the corresponding login endpoint."}}},"paths":{"/api/vendor-user/change-password":{"put":{"operationId":"putApiVendorUserChangePassword","summary":"Update User Change Password","description":"Put /api/vendor-user/change-password\n\n**Authentication:** Vendor bearer token required for protected operations; verify exact permission decorator in controller.\n\n**Feature area:** Change Password\n\n**Implementation source:** `src/api/vendor/controllers/VendorController.ts`\n\n**Request example provenance:** Illustrative password-change body; verify exact DTO names and policy.\n\n**Response example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n> **Example status: Illustrative.** The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema. Example is illustrative and does not guarantee a stable response contract.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"},"status":{"type":"integer"}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Error response example. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}},"requestBody":{"required":false,"description":"Sample request body. Illustrative password-change body; verify exact DTO names and policy. Treat this as an illustrative example, not a complete DTO contract.","content":{"application/json":{"schema":{"type":"object","properties":{"oldPassword":{"type":"string","writeOnly":true},"newPassword":{"type":"string","writeOnly":true},"confirmPassword":{"type":"string"}},"additionalProperties":true}}}}}}}}
```

## Create or process User Edit Profile

> Post /api/vendor-user/edit-profile\
> \
> \*\*Authentication:\*\* Vendor bearer token required for protected operations; verify exact permission decorator in controller.\
> \
> \*\*Feature area:\*\* User Management\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorController.ts\`\
> \
> \*\*Request example provenance:\*\* Illustrative user profile body; check request DTO.\
> \
> \*\*Response example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \> \*\*Example status: Illustrative.\*\* The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Paste the JWT access token returned by the corresponding login endpoint."}}},"paths":{"/api/vendor-user/edit-profile":{"post":{"operationId":"postApiVendorUserEditProfile","summary":"Create or process User Edit Profile","description":"Post /api/vendor-user/edit-profile\n\n**Authentication:** Vendor bearer token required for protected operations; verify exact permission decorator in controller.\n\n**Feature area:** User Management\n\n**Implementation source:** `src/api/vendor/controllers/VendorController.ts`\n\n**Request example provenance:** Illustrative user profile body; check request DTO.\n\n**Response example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n> **Example status: Illustrative.** The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema. Example is illustrative and does not guarantee a stable response contract.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"object","properties":{"userId":{"type":"integer"},"firstName":{"type":"string"},"lastName":{"type":"string"},"email":{"type":"string"}},"additionalProperties":true}},"additionalProperties":true}}}},"400":{"description":"Error response example. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}},"requestBody":{"required":false,"description":"Sample request body. Illustrative user profile body; check request DTO. Treat this as an illustrative example, not a complete DTO contract.","content":{"application/json":{"schema":{"type":"object","properties":{"firstName":{"type":"string"},"lastName":{"type":"string"},"email":{"type":"string"},"phoneNumber":{"type":"string"}},"additionalProperties":true}}}}}}}}
```

## Retrieve User Get Profile

> Get /api/vendor-user/get-profile\
> \
> \*\*Authentication:\*\* Vendor bearer token required for protected operations; verify exact permission decorator in controller.\
> \
> \*\*Feature area:\*\* User Management\
> \
> \*\*Implementation source:\*\* \`src/api/vendor/controllers/VendorController.ts\`\
> \
> \*\*Request example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \*\*Response example provenance:\*\* Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\
> \
> \> \*\*Example status: Illustrative.\*\* The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.

```json
{"openapi":"3.0.3","info":{"title":"SpurtCommerce Vendor API","version":"6.0.0"},"tags":[{"name":"Vendor account and authentication","description":"Authenticate vendor users and manage account credentials and profile."}],"servers":[{"url":"https://api.example.com","description":"Replace with your SpurtCommerce API host. Paths include the /api prefix."}],"security":[{"BearerAuth":[]}],"components":{"securitySchemes":{"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Paste the JWT access token returned by the corresponding login endpoint."}}},"paths":{"/api/vendor-user/get-profile":{"get":{"operationId":"getApiVendorUserGetProfile","summary":"Retrieve User Get Profile","description":"Get /api/vendor-user/get-profile\n\n**Authentication:** Vendor bearer token required for protected operations; verify exact permission decorator in controller.\n\n**Feature area:** User Management\n\n**Implementation source:** `src/api/vendor/controllers/VendorController.ts`\n\n**Request example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n**Response example provenance:** Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.\n\n> **Example status: Illustrative.** The example is included to demonstrate request/response shape in the reference UI; verify the owning controller and request DTO before using it as a contract.","tags":["Vendor account and authentication"],"responses":{"200":{"description":"Successful response. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema. Example is illustrative and does not guarantee a stable response contract.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"},"data":{"type":"array","items":{"type":"object","properties":{"userId":{"type":"integer"},"firstName":{"type":"string"},"lastName":{"type":"string"},"email":{"type":"string"}},"additionalProperties":true}}},"additionalProperties":true}}}},"400":{"description":"Error response example. Illustrative response envelope only. This route inventory does not include its route-specific @apiSuccessExample; response fields and messages must be verified in the matching controller/service. The example is intended to show the common response-wrapper style, not to define a guaranteed response schema.","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"integer"},"message":{"type":"string"}},"additionalProperties":true}}}}}}}}}
```