TBBNMerchantDocs
Available

Sellers

post/merchant/sellers/verify

Merchant-facing: register or match a seller after the MERCHANT has verified them. See the Glossary guide "Identity federation" — sellers never call this directly.

curl -X POST https://api.tbbnetwork.com/merchant/sellers/verify \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Acme Co.",
  "verifiedEmail": "you@example.com",
  "verifiedPhone": "+1-555-0173",
  "merchantSellerRef": "merchantSellerRef",
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
}'

Parameters

Request body

FieldTypeRequired
namestringyes
verifiedEmailstring (email)yes
verifiedPhonestringyes
merchantSellerRefstringyes
merchantIdstring (uuid)yes

Response (200)

FieldTypeRequired
sellerIdstring (uuid)—
requiresConfirmationboolean—
Example 200 response
{
  "sellerId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "requiresConfirmation": false
}
post/merchant/sellers/headless

Merchant-facing: create a headless Seller — a trade participant with no linked TBBN account, gated by the calling Merchant's plan tier.

curl -X POST https://api.tbbnetwork.com/merchant/sellers/headless \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "merchantSellerRef": "merchantSellerRef",
  "name": null
}'

Parameters

Request body

FieldTypeRequired
merchantIdstring (uuid)yes
merchantSellerRefstringyes
namestringnull—

Response (200)

FieldTypeRequired
idstring (uuid)—
userIdstring,null (uuid)—
primaryEmailstringnull—
primaryPhonestringnull—
reputationScoreintegernull—
Example 200 response
{
  "id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "userId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "primaryEmail": null,
  "primaryPhone": null,
  "reputationScore": null
}

Possible errors

422This merchant's plan tier does not allow headless Sellers
post/merchant/sellers/link-code

Redeem a customer's TBBN link code — the one-time code they made in their TBBN account (Linked stores → Link a store) and entered in their account on your site. Links their TBBN account to your store as the OAuth handshake does, under your reference for them (merchant_seller_ref, optional — without it the link is keyed by their TBBN seller id). A code works once, for 30 minutes; a failed link (409) leaves it usable.

curl -X POST https://api.tbbnetwork.com/merchant/sellers/link-code \
  -H "Authorization: Bearer sk_sandbox_..." \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "code": "7Q4K-9M2X",
  "merchant_seller_ref": "merchant_seller_ref"
}'

Parameters

Request body

FieldTypeRequired
codestringyes
merchant_seller_refstring—

Response (201)

FieldTypeRequired
sellerIdstring (uuid)—
merchantSellerRefstring—
linkedboolean—
attributedListingsinteger—
Example 201 response
{
  "sellerId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "merchantSellerRef": "merchantSellerRef",
  "linked": false,
  "attributedListings": 1
}

Possible errors

400LINK_CODE_INVALID — wrong, used or expired
409SELLER_REF_LINKED_TO_ANOTHER — that reference is linked to someone else

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
post/v1/oauth-clients

Register a Merchant's account-linking OAuth client

curl -X POST https://api.tbbnetwork.com/v1/oauth-clients \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "redirectUris": [
    "value"
  ]
}'

Parameters

Request body

FieldTypeRequired
merchantIdstring (uuid)yes
redirectUrisstring[]yes

Response (200)

FieldTypeRequired
idstring (uuid)—
merchantIdstring (uuid)—
clientIdstring—
clientSecretstring—
redirectUrisstring[]—
statusACTIVE | REVOKED—
createdAtstring (date-time)—
Example 200 response
{
  "id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "clientId": "clientId",
  "clientSecret": "clientSecret",
  "redirectUris": [
    "value"
  ],
  "status": "ACTIVE",
  "createdAt": "2026-07-01T12:00:00Z"
}
get/v1/oauth-clients

List a Merchant's OAuth clients

curl -X GET https://api.tbbnetwork.com/v1/oauth-clients \
  -H "Authorization: Bearer <session access token>" \

Parameters

merchantIdqueryrequired

Response (200)

Example 200 response
[
  {
    "id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "clientId": "clientId",
    "clientSecret": "clientSecret",
    "redirectUris": [
      "value"
    ],
    "status": "ACTIVE",
    "createdAt": "2026-07-01T12:00:00Z"
  }
]
post/v1/oauth-clients/{id}/rotate-secret

Rotate an OAuth client's secret — the clientId is unchanged

curl -X POST https://api.tbbnetwork.com/v1/oauth-clients/{id}/rotate-secret \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \

Parameters

idpathrequired

Response (200)

FieldTypeRequired
idstring (uuid)—
merchantIdstring (uuid)—
clientIdstring—
clientSecretstring—
redirectUrisstring[]—
statusACTIVE | REVOKED—
createdAtstring (date-time)—
Example 200 response
{
  "id": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "clientId": "clientId",
  "clientSecret": "clientSecret",
  "redirectUris": [
    "value"
  ],
  "status": "ACTIVE",
  "createdAt": "2026-07-01T12:00:00Z"
}
delete/v1/oauth-clients/{id}

Revoke an OAuth client

curl -X DELETE https://api.tbbnetwork.com/v1/oauth-clients/{id} \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \

Parameters

idpathrequired
get/v1/link/oauth/clients/{clientId}

Public client metadata — used by TBBN's account consent screen to validate redirect_uri and render "Merchant X wants to link your TBBN profile" before showing Approve/Deny.

curl -X GET https://api.tbbnetwork.com/v1/link/oauth/clients/{clientId} \
  -H "Authorization: Bearer sk_sandbox_..." \

Parameters

clientIdpathrequired

Response (200)

FieldTypeRequired
clientIdstring—
redirectUrisstring[]—
merchantDisplayNamestringnull—
Example 200 response
{
  "clientId": "clientId",
  "redirectUris": [
    "value"
  ],
  "merchantDisplayName": null
}
post/v1/link/oauth/consent

Step 1 of the OAuth account-linking handshake — the logged-in member approves. Creates a short-lived, single-use authorization code; the caller (the consent page) performs the actual redirect.

curl -X POST https://api.tbbnetwork.com/v1/link/oauth/consent \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "clientId": "clientId",
  "redirectUri": "redirectUri",
  "scope": "link:seller",
  "codeChallenge": "codeChallenge",
  "codeChallengeMethod": "S256",
  "merchantSellerRef": "merchantSellerRef"
}'

Request body

FieldTypeRequired
clientIdstringyes
redirectUristring (uri)yes
scopestringyes
codeChallengestring—
codeChallengeMethodS256—
merchantSellerRefstring—

Response (200)

FieldTypeRequired
codestring—
Example 200 response
{
  "code": "code"
}
post/v1/link/oauth/token

Exchange an account-linking authorization code for the link — from your server, within 5 minutes, once. Returns the seller's id; no access or refresh token is issued. See the Seller account linking guide.

curl -X POST https://api.tbbnetwork.com/v1/link/oauth/token \
  -H "Authorization: Bearer sk_sandbox_..." \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "grant_type": "authorization_code",
  "code": "code",
  "client_id": "client_id",
  "client_secret": "client_secret",
  "redirect_uri": "redirect_uri",
  "code_verifier": "code_verifier"
}'

Request body

FieldTypeRequired
grant_typeauthorization_codeyes
codestringyes
client_idstringyes
client_secretstringyes
redirect_uristring (uri)yes
code_verifierstring—

Response (200)

FieldTypeRequired
sellerIdstring (uuid)—
merchantSellerRefstring—
linkedboolean—
attributedListingsinteger—
Example 200 response
{
  "sellerId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "merchantSellerRef": "merchantSellerRef",
  "linked": false,
  "attributedListings": 1
}
post/v1/sellers/me/link-codes

Make a one-time link code (30 minutes) the signed-in member gives a store to link their account. At most five unused at once.

curl -X POST https://api.tbbnetwork.com/v1/sellers/me/link-codes \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \

Response (201)

FieldTypeRequired
codestring—
expiresAtstring (date-time)—
Example 201 response
{
  "code": "7Q4K-9M2X",
  "expiresAt": "2026-07-01T12:00:00Z"
}

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
get/v1/sellers/me/storefront

The signed-in member's storefront address (tbbnetwork.com/store/{slug}) and bio; the address is made from their name the first time.

curl -X GET https://api.tbbnetwork.com/v1/sellers/me/storefront \
  -H "Authorization: Bearer <session access token>" \

Response (200)

FieldTypeRequired
slugstring—
biostringnull—
Example 200 response
{
  "slug": "example-slug",
  "bio": null
}

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
patch/v1/sellers/me/storefront

Change the storefront's address or bio

curl -X PATCH https://api.tbbnetwork.com/v1/sellers/me/storefront \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "slug": "example-slug",
  "bio": "bio"
}'

Request body

FieldTypeRequired
slugstring—
biostring—

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
get/v1/sellers/me/linkable-stores

Stores where a member connects their TBBN account on the store's own site

curl -X GET https://api.tbbnetwork.com/v1/sellers/me/linkable-stores \
  -H "Authorization: Bearer <session access token>" \

Response (200)

Example 200 response
[
  {
    "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "name": "Acme Co.",
    "logoUrl": null,
    "linkAccountUrl": "https://example.com/resource"
  }
]

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
delete/v1/sellers/me/links/{merchantId}

Unlink the signed-in member from a store

curl -X DELETE https://api.tbbnetwork.com/v1/sellers/me/links/{merchantId} \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \

Parameters

merchantIdpathrequired

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
get/v1/sellers

List your linked sellers, newest link first

curl -X GET https://api.tbbnetwork.com/v1/sellers \
  -H "Authorization: Bearer sk_sandbox_..." \

Parameters

merchantIdqueryrequired

Response (200)

Example 200 response
[
  {
    "sellerId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
    "name": null,
    "merchantSellerRef": null,
    "linkedMerchantCount": 1,
    "federated": false
  }
]

Possible errors

Any other failure (validation, auth, rate limiting, a resource that doesn't exist) returns this same envelope with a non-2xx status — error.code is stable and safe to branch on; error.requestId is worth logging and including in a support request.

Example error response
{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "A human-readable description of what went wrong.",
    "requestId": "req_01hxyz..."
  }
}
post/v1/sellers/{id}/unlink

Unlink one of your sellers. Your live listings for that seller come down; refused (409) while a trade through your store is in progress.

curl -X POST https://api.tbbnetwork.com/v1/sellers/{id}/unlink \
  -H "Authorization: Bearer <session access token>" \
  -H "Idempotency-Key: 5f2f...b91" \
  -H "Content-Type: application/json" \
  -d '{
  "merchantId": "a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
}'

Parameters

idpathrequired

Request body

FieldTypeRequired
merchantIdstring (uuid)yes