The Membber Platform API

One versioned surface for everything on the platform: membership, loyalty, orders, bookings, classes, reports and more. Every operation below is rendered directly from the same generated contract that produces our TypeScript and Swift SDKs, so these pages always match production.

179 operations41 domainsbase URL https://www.membber.comversion v1

Base URL and versioning

All endpoints live under https://www.membber.com/api/v1. The v1 namespace is stable: changes are additive, and anything breaking would ship as a new version, never as a silent change to v1. Requests and responses are JSON over HTTPS.

Try the public liveness probe

curl "https://www.membber.com/api/v1/system/ping"

Authentication

Every non-public operation requires a Bearer token in the Authorization header, and each operation states the permission scope it needs (for example merchant:read). Today tokens come from a signed-in Membber session: the customer app uses a Membber session token and the business app uses its staff session. Merchants can also issue scoped agent keys (mbr_live_...) from the Membber Place app for a small, allowlisted set of operations. There is no self-serve partner key flow yet. The full story, including exactly what an agent key can call, is in the authentication guide.

Authenticated request

curl -G "https://www.membber.com/api/v1/loyalty/state" \
  -H "Authorization: Bearer $MEMBBER_TOKEN" \
  --data-urlencode "store_id=<store-id>"

Errors

Every error, on every operation, uses one envelope with a stable machine-readable code, a human-readable message, and a requestId you can quote to support. Full code list in the errors guide.

Error envelope, 400

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "store_id must be a UUID.",
    "requestId": "req_2f3a9c81d4b7"
  }
}

Error envelope model

errorobjectrequired

4 child fields

codestringrequired

messagestringrequired

detailsobjectoptional

requestIdstringrequired

Permission scopes

Scopes follow an audience:action shape. The audiences map to who is calling: merchant and staff scopes are presented by the business surface, customer scopes by the customer surface.

Scope	Held by
`customer:read`	Customer sessions in the Membber app and App Clip
`customer:write`	Customer sessions in the Membber app and App Clip
`internal-admin`	Customer sessions in the Membber app and App Clip
`merchant:read`	Merchant sessions, and agent keys where allowlisted
`merchant:write`	Merchant sessions, and agent keys where allowlisted
`staff:approve`	Staff sessions with the matching front-desk permission
`staff:checkin`	Staff sessions with the matching front-desk permission
`staff:enrol`	Staff sessions with the matching front-desk permission
`staff:redeem`	Staff sessions with the matching front-desk permission

Base URL and versioning

Authentication

Errors

Error envelope model

Permission scopes

Browse by domain