Accounts & profiles

Every audience has the same profile endpoints under its own prefix: profile/me to read, profile to update, profile/password to change the password and profile/delete-account.

	Customer	Driver	Merchant
Read	profile/me	profile/me	profile/me
Update	profile	profile	profile
Password	profile/password	profile/password	profile/password
Delete	delete-account	delete-account	delete-account

Send profile updates with a file (avatar, logo, documents) as POST multipart; see Uploads.

Changing the password#

Send old_password and new_password. A wrong old_password returns 422. The new password must contain upper and lower case letters, a number and a symbol — stricter than customer and merchant registration, which only ask for 8 characters (see Known quirks). Other sessions stay signed in.

Deleting an account#

Deleting is immediate and signs the account out on every device: all its tokens are revoked and its push tokens removed. Show a clear confirmation first.

• Customer and driver: the account is closed. Logging in again with it returns 403 with a message to contact support; it cannot be reopened from the app. A driver is also taken off duty.
• Merchant owner: closing the owner account also deactivates every store it owns and deletes all of its staff accounts, which are signed out at once. Say so in the confirmation.
• Merchant staff: closes only the staff member's own account.

Past orders keep their history; Tote can still see them.

Favourites (customer)#

A favourite is a product in a given store. POST favorites/toggle with product_id and store_id adds it, or removes it if it is already there. A product the store no longer sells cannot be added (422). GET favorites lists them.

Store catalog listings mark favourites with is_favorite for customers.

Friends (customer)#

Customers can connect with each other:

stateDiagram-v2
    [*] --> pending: request sent
    pending --> accepted: receiver accepts
    pending --> rejected: receiver rejects
    pending --> blocked: receiver blocks
    rejected --> pending: either one asks again

• POST friendships/request with receiver_id sends a request. Asking yourself is refused. A pair has only one friendship, in either direction:
  • a pending or accepted one makes a new request return 409 with its status;
  • a rejected one can be asked again by either person — it becomes a new pending request from the one asking, with the same id;
  • if either side blocked the other, a request returns 403. Blocking is how a customer stops repeated requests.
• Only the receiver answers, with POST friendships/{friendship}/respond and status: accepted, rejected or blocked.
• Lists: incoming requests, friends, blocked.

Both steps send a push (friend_request, friend_request_answered).