Skip to main content
Customer-facing identity and profile data. Customer management covers customer registration, authentication, profile data, addresses, and customer-related activity. Confirm the enabled customer capabilities in the target deployment; the legacy v5 documentation is not proof that a particular v6 route exists.

Typical lifecycle

  1. A customer registers or is provisioned through an enabled identity flow.
  2. The account is verified if verification is enabled.
  3. The customer authenticates and receives the session/token format defined by the API.
  4. Profile and address operations are performed within the authenticated customer’s scope.
  5. Administrative support or account lifecycle actions are governed by permissions and audit requirements.

Integration considerations

  • Never trust a customer ID supplied by the client to establish ownership.
  • Derive identity from the authenticated principal and enforce tenant/store scope server-side.
  • Validate email, phone, address, and consent fields.
  • Apply rate limits to login, OTP, password reset, and verification flows.
  • Avoid returning password hashes, OTPs, internal notes, or unnecessary personal data.
  • Define account deletion, anonymization, and retention behavior according to policy.

Source verification

Inspect customer controllers, services, entities, authentication middleware, and migrations under src. Use the generated API documentation for exact paths and schemas.