Register a new end-user against the calling publisher.
Header Parameters
Accepted for forward compatibility but not currently enforced by the server, so a retry with the same key is processed again. Do not rely on it to prevent duplicates. Deduplicate on your side using your own order reference, and avoid refreshing or replaying payment success pages.
Media type the client can parse. Always application/json for this API.
application/jsonBody Parameters
Your unique identifier for this user. Must be unique within your publisher's namespace.
Optional. User's display name. Defaults to - if omitted.
Optional. User's email address.
Optional phone number.
Internal flag. Do not send this parameter. When 1, it suppresses the mirror insert into the
publisher's linked database and the call still succeeds, so the omission is silent. Defaults to 0.
01Response
User created, or a duplicate UID was detected. Check users.response in the body: 200 means
the user was created and the record (including token for white-label publishers) is returned; 400 means
the request was rejected in the body even though the HTTP status is 200, for example because the
UID already exists (no token is returned in that case).
Response Attributes
Newly-created user record wrapped in the standard users envelope. Variant branches
on publisher type the same way GetUsersListResponse does.
Show child attributes
Show child attributes
Request failed validation, or the UID is already registered under this publisher.
Body shape is {"message": "REASON"} (with an extra response: 400 field for
the User already exists variant).
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Authentication failed. Common causes: missing Authorization header, malformed bearer
token, token expired (tokens live 10 hours), or — on getToken itself — HMAC signature
mismatch due to clock drift or wrong secret.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Your publisher account has an IP allow-list and the request came from an address that is not on it. The API checks the caller's IP address on every request once a list exists. Ask Spendstream to add the address, or to clear the list if you do not want the restriction. See IP allow-listing in the guide.
Response Attributes
Rate limit exceeded. The POST /getToken endpoint is rate-limited to five requests
per minute, and the limit is currently shared across all publishers; other endpoints may be throttled at the reverse-proxy layer
in response to abusive traffic. Wait and retry with exponential backoff; the
Retry-After header tells you the minimum wait in seconds.
Response Attributes
Human-readable failure reason. Safe to surface to integrators but not end-users.
Alternative error message field used by a subset of endpoints (notably getToken
and authentication failures). Integrators should check for both message and
error when parsing failure responses.
Numeric status code echoing the HTTP status (e.g. 400, 401). Populated on
most error paths; a few auth-layer failures omit it.
Response