Get Portal Branding
GET/api/portal/branding
Get the merchant's portal branding for the pages a buyer sees before signing in (sign-in, register, accept-invite). No authentication: the tenant is resolved from the portal host.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Returns the buyer-safe subset only (data): logo_url, mark_url (null when none uploaded), display_name (falls back to the merchant's store name), primary_color, nav_color (uppercase #RRGGBB; SKU defaults #0096DD / #1F2937 when unset), on_primary_color, on_nav_color (the readable text colour on each: #FFFFFF or #111827), support_email and version (bumped on every branding change; append it to image URLs to bust caches). Contrast ratios, warnings and whether the name was defaulted are staff-only and never returned here.
Cacheable: the response carries Cache-Control: public, max-age=300. Rate limited to 60 requests per minute. Signed-in buyers get the same object as branding on Get Current Buyer.
Request
Responses
- 200
- 401
- 403
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.