Update Retailer
curl --request PATCH \
--url https://api.example.com/retailers/{retailer_id} \
--header 'Content-Type: application/json' \
--data '
{
"enabled": true,
"link_visibility": "restricted",
"link_audience": {
"allowed_emails": [
"<string>"
],
"allowed_domains": [
"<string>"
]
}
}
'import requests
url = "https://api.example.com/retailers/{retailer_id}"
payload = {
"enabled": True,
"link_visibility": "restricted",
"link_audience": {
"allowed_emails": ["<string>"],
"allowed_domains": ["<string>"]
}
}
headers = {"Content-Type": "application/json"}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
enabled: true,
link_visibility: 'restricted',
link_audience: {allowed_emails: ['<string>'], allowed_domains: ['<string>']}
})
};
fetch('https://api.example.com/retailers/{retailer_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/retailers/{retailer_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'enabled' => true,
'link_visibility' => 'restricted',
'link_audience' => [
'allowed_emails' => [
'<string>'
],
'allowed_domains' => [
'<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/retailers/{retailer_id}"
payload := strings.NewReader("{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.example.com/retailers/{retailer_id}")
.header("Content-Type", "application/json")
.body("{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/retailers/{retailer_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"retailer_id": "walmart",
"name": "Walmart",
"images": {
"logo": {
"light": "<string>",
"dark": "<string>"
},
"icon": {
"light": "<string>",
"dark": "<string>"
}
},
"status": "active",
"enabled": true,
"link_url": "https://link.subtotal.com/a1b2c3d4",
"link_visibility": "everyone",
"link_audience": {
"allowed_emails": [
"<string>"
],
"allowed_domains": [
"example.com"
]
}
}Retailers
Update Retailer
Update a retailer for the client. Every field is optional and omitted fields are unchanged: enabled turns the retailer on or off; link_visibility and link_audience set who sees it on the Subtotal Link selection page (link_audience replaces the stored allow-lists). Link settings need the retailer enabled, already or in the same request. Idempotent; returns the retailer row after the update. Disabling removes the client’s configuration for the retailer: a later re-enable issues a new link_url and resets link_visibility to everyone.
PATCH
/
retailers
/
{retailer_id}
Update Retailer
curl --request PATCH \
--url https://api.example.com/retailers/{retailer_id} \
--header 'Content-Type: application/json' \
--data '
{
"enabled": true,
"link_visibility": "restricted",
"link_audience": {
"allowed_emails": [
"<string>"
],
"allowed_domains": [
"<string>"
]
}
}
'import requests
url = "https://api.example.com/retailers/{retailer_id}"
payload = {
"enabled": True,
"link_visibility": "restricted",
"link_audience": {
"allowed_emails": ["<string>"],
"allowed_domains": ["<string>"]
}
}
headers = {"Content-Type": "application/json"}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
enabled: true,
link_visibility: 'restricted',
link_audience: {allowed_emails: ['<string>'], allowed_domains: ['<string>']}
})
};
fetch('https://api.example.com/retailers/{retailer_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/retailers/{retailer_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'enabled' => true,
'link_visibility' => 'restricted',
'link_audience' => [
'allowed_emails' => [
'<string>'
],
'allowed_domains' => [
'<string>'
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/retailers/{retailer_id}"
payload := strings.NewReader("{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.example.com/retailers/{retailer_id}")
.header("Content-Type", "application/json")
.body("{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/retailers/{retailer_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"enabled\": true,\n \"link_visibility\": \"restricted\",\n \"link_audience\": {\n \"allowed_emails\": [\n \"<string>\"\n ],\n \"allowed_domains\": [\n \"<string>\"\n ]\n }\n}"
response = http.request(request)
puts response.read_body{
"retailer_id": "walmart",
"name": "Walmart",
"images": {
"logo": {
"light": "<string>",
"dark": "<string>"
},
"icon": {
"light": "<string>",
"dark": "<string>"
}
},
"status": "active",
"enabled": true,
"link_url": "https://link.subtotal.com/a1b2c3d4",
"link_visibility": "everyone",
"link_audience": {
"allowed_emails": [
"<string>"
],
"allowed_domains": [
"example.com"
]
}
}Access
Call this endpoint with your API key, or with a Subtotal Data MCP connector’s OAuth token that includesretailers:write. A token without retailers:write receives 403 insufficient_scope. Partner app tokens don’t include it.
Enable or disable a retailer
curl --request PATCH 'https://api.subtotal.com/retailers/walmart' \
--header "x-api-key: $SUBTOTAL_API_KEY" \
--header 'Content-Type: application/json' \
--data '{"enabled": true}'
Disabling removes your configuration for the retailer. Links you’ve already shared stop working, and re-enabling issues a new
link_url with link_visibility reset to everyone.Control who sees a retailer in Subtotal Link
link_visibility sets who sees the retailer on the Subtotal Link retailer-selection page: everyone, restricted (only consumers matching link_audience), or hidden. The retailer’s link_url works regardless of visibility.
curl --request PATCH 'https://api.subtotal.com/retailers/walmart' \
--header "x-api-key: $SUBTOTAL_API_KEY" \
--header 'Content-Type: application/json' \
--data '{
"link_visibility": "restricted",
"link_audience": {"allowed_emails": ["tester@example.com"], "allowed_domains": ["example.com"]}
}'
- Fields you omit are left unchanged.
link_audiencereplaces the stored lists. Send both lists to keep entries you want.restrictedneeds at least one email or domain, counting lists already stored.- Link settings need the retailer enabled. Send
"enabled": truein the same request to enable and configure it at once.
Errors
| Status | When |
|---|---|
404 | Unknown retailer_id, or Link settings for a retailer that isn’t enabled |
422 | Invalid body: an empty body, unknown fields, invalid emails or domains, restricted with no audience, or Link settings sent while disabling |
Path Parameters
Body
application/json
The shared retailer update body (ENG-2121), used by every retailer update entry point.
Every field is optional; an omitted field is left unchanged.
true enables the retailer for the client; false disables it. Disabling removes the client's configuration for the retailer: a later re-enable issues a new link_url and resets link_visibility to everyone.
Who sees the retailer on the Subtotal Link retailer-selection page: everyone | restricted (only consumers matching link_audience) | hidden. Requires the retailer to be enabled.
Available options:
everyone, restricted, hidden Example:
"restricted"
Replaces the stored allow-lists used when link_visibility is restricted. Requires the retailer to be enabled.
Show child attributes
Show child attributes
Response
Successful Response
One annotated retailer row of the discovery contract.
Retailer slug — the exact value passed to the retailers[] filter across surfaces.
Example:
"walmart"
Retailer display name.
Example:
"Walmart"
Logos and icons for the retailer.
Show child attributes
Show child attributes
Platform status: active | limited | inactive.
Example:
"active"
Whether this retailer is enabled for this client (a ClientMerchants row exists).
URL to launch Subtotal Link for the retailer. Present only when the retailer is enabled.
Example:
"https://link.subtotal.com/a1b2c3d4"
Who sees the retailer on the Subtotal Link retailer-selection page: everyone | restricted (only consumers matching link_audience) | hidden. link_url works regardless. Present only when the retailer is enabled.
Available options:
everyone, restricted, hidden Example:
"everyone"
Allow-lists applied when link_visibility is restricted. Present only when the retailer is enabled.
Show child attributes
Show child attributes