> ## Documentation Index
> Fetch the complete documentation index at: https://swapnice.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create or upsert a customer

> Create the partner-scoped user. Body field is external_id, not customer_id.

Create the partner-scoped user. Body field is external\_id, not customer\_id.

`profile` accepts public display fields only. Do not send payment, government-id, or credential data.


## OpenAPI

````yaml openapi.yaml POST /v1/customers
openapi: 3.0.3
info:
  title: Swapnice Partner API
  version: 0.1.0
  description: >
    Swapnice's partner API lets trusted partner applications connect customer
    accounts,

    collect explicit consent, ingest governed events and claims, and
    synchronously read

    consent-filtered profile intelligence with provenance.


    The API is designed for a Cloudflare Workers gateway backed by Durable
    Objects for

    short-lived sessions, per-customer ordering, consent coordination, and
    idempotency,

    plus D1 for longer-lived partner app configuration, consent archives, token
    metadata,

    customer records, and audit history.


    Public schemas use descriptive field names. Compact Firebase-era storage
    keys such as

    `c0`, `p0`, or `upiv` are internal implementation details and must not be
    exposed.
  contact:
    name: Swapnice API Support
    email: api@swapnice.com
  license:
    name: Proprietary
    url: https://swapnice.com/legal/api-terms
servers:
  - url: https://api.swapnice.com
    description: Production API
  - url: https://api.sandbox.swapnice.com
    description: Sandbox API
security:
  - OAuth2: []
tags:
  - name: OAuth
    description: OAuth 2.1 authorization, token, introspection, revocation, and discovery.
  - name: Apps
    description: Partner OAuth application configuration and webhook endpoints.
  - name: Connection Sessions
    description: Short-lived account-linking sessions coordinated by Durable Objects.
  - name: Consent
    description: Consent grants, receipts, effective consent state, and revocation.
  - name: Customers
    description: Partner-scoped customer records and metadata.
  - name: Ontologies
    description: Ontology contracts and filter-field metadata for entries and events.
  - name: Entries
    description: Ontology-backed collectible entries using readable external fields.
  - name: Events
    description: Non-blocking ordered event and claim ingestion.
  - name: Profiles
    description: Consent-aware synchronous reads for claims, intents, and profile facts.
  - name: Webhooks
    description: Partner webhook endpoint registration and delivery status.
paths:
  /v1/customers:
    post:
      tags:
        - Customers
      summary: Create or upsert a partner customer
      description: >-
        Customer writes are app-scoped and idempotent. Private user, wallet,
        precise place, and token fields are never exposed.
      operationId: upsertCustomer
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CustomerUpsertRequest'
            example:
              external_id: partner_user_1842
              profile:
                username: collector1842
              metadata:
                source: ios
      responses:
        '200':
          description: Customer created, updated, or unchanged.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomerUpsertResponse'
              example:
                status: created
                customer:
                  id: cust_8f2a1c
                  app_id: app_91b0
                  external_id: partner_user_1842
                  status: active
                  profile:
                    username: collector1842
                  metadata:
                    source: ios
                  created_at: '2026-08-26T16:01:00.000Z'
                  updated_at: '2026-08-26T16:01:00.000Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '409':
          $ref: '#/components/responses/Conflict'
      security:
        - OAuth2:
            - customers:write
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: true
      description: >
        Required for mutating requests. Replays with the same key and payload
        hash return

        the original logical result; replays with a different payload hash
        return `409`.
      schema:
        type: string
        minLength: 16
        maxLength: 255
      example: idem_01HZZZ8KQ2J9X2RW7B8Y4D2FPK
  schemas:
    CustomerUpsertRequest:
      type: object
      required:
        - external_id
      properties:
        external_id:
          type: string
        profile:
          $ref: '#/components/schemas/PublicProfileFields'
        metadata:
          $ref: '#/components/schemas/Metadata'
    CustomerUpsertResponse:
      type: object
      required:
        - status
        - customer
      properties:
        status:
          type: string
          enum:
            - created
            - updated
            - unchanged
        customer:
          $ref: '#/components/schemas/Customer'
    PublicProfileFields:
      type: object
      properties:
        username:
          type: string
        bio_markdown:
          type: string
        avatar_url:
          type: string
          format: uri
        banner_url:
          type: string
          format: uri
        public_location:
          type: object
          properties:
            city:
              type: string
            state:
              type: string
            country:
              type: string
            metro_code:
              type: string
    Metadata:
      type: object
      additionalProperties: true
    Customer:
      type: object
      required:
        - id
        - app_id
        - external_id
        - status
        - created_at
        - updated_at
      properties:
        id:
          type: string
        app_id:
          type: string
        external_id:
          type: string
        status:
          type: string
          enum:
            - active
            - disconnected
            - deleted
        profile:
          $ref: '#/components/schemas/PublicProfileFields'
        metadata:
          $ref: '#/components/schemas/Metadata'
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              example: consent_denied
            message:
              type: string
            request_id:
              type: string
            details:
              type: array
              items:
                $ref: '#/components/schemas/ErrorDetail'
    ErrorDetail:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
        message:
          type: string
        field:
          type: string
  responses:
    BadRequest:
      description: Invalid request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Conflict:
      description: Idempotency conflict or invalid state transition.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    OAuth2:
      type: oauth2
      description: >-
        OAuth 2.1 authorization code with PKCE. Implicit and password flows are
        unsupported.
      flows:
        authorizationCode:
          authorizationUrl: https://api.swapnice.com/oauth/authorize
          tokenUrl: https://api.swapnice.com/oauth/token
          refreshUrl: https://api.swapnice.com/oauth/token
          scopes:
            offline_access: Issue rotating refresh tokens when allowed.
            apps:read: Read partner app configuration.
            apps:write: Manage partner app configuration.
            connections:read: Read connection sessions.
            connections:write: Create or cancel connection sessions.
            consent:read: Read consent receipts and effective consent.
            consent:write: Create and revoke consent.
            customers:read: Read partner customers.
            customers:write: Create or update partner customers.
            ontologies:read: Read ontologies and field maps.
            ontologies:write: Rebuild ontology filter metadata.
            entries:read: Read ontology-backed entries.
            entries:write: Create or update ontology-backed entries.
            events:read: Read event status.
            events:write: Ingest events and claims.
            profile:read: Read resolved profile facts.
            profiles:read: Read profile resources.
            claims:read: Read claims.
            intents:read: Read intents.
            webhooks:read: Read webhook endpoints.
            webhooks:write: Manage webhook endpoints.
            workflows:read: Read async workflow status.
            tokens:introspect: Introspect tokens.
            tokens:revoke: Revoke tokens.

````