List active promotions with embedded brand detail.
Header Parameters
Media type the client can parse. Always application/json for this API.
application/jsonQuery Parameters
1-based page index for paginated collection endpoints. When omitted, the first page
is returned. Response bodies include prev and next URLs for navigation.
Inclusive lower bound for date-range filtering. Format YYYY-MM-DD. Must be paired
with to-date; both bounds apply or neither.
Inclusive upper bound for date-range filtering. Format YYYY-MM-DD. Must be paired
with from-date.
Filter by brand status. 1 = active, 0 = inactive. Note that two inactive states
(0 and 2) currently exist in responses — they are not yet distinguished in the
status dictionary. See the status-dictionaries reference.
012Filter to promotions for a single brand (note the capitalised ID — kept as-is for backwards compatibility).
Response
Promotion list with embedded brand detail returned.
Response Attributes
Show child attributes
Authentication failed. Common causes: missing Authorization header, malformed bearer
token, token expired (tokens live 10 hours), or — on getToken itself — HMAC signature
mismatch due to clock drift or wrong secret.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Rate limit exceeded. The POST /getToken endpoint is rate-limited to five requests
per minute per source IP; other endpoints may be throttled at the reverse-proxy layer
in response to abusive traffic. Wait and retry with exponential backoff; the
Retry-After header tells you the minimum wait in seconds.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Response