Which endpoints do the RevenueCat SDKs call on RevenueDot?

The RevenueCat SDKs call these endpoints when their proxy URL points at RevenueDot. They take a public app key (appl_, goog_, test_ ...), which is safe to ship in an app. Several also accept a secret key for server-side use. Errors use the SDK's error format { "code": 7103, "message": "..." }; see Errors. Responses under /v1 and /rcbilling are signed when the server has a signing key; see Trusted Entitlements.

Base URL: your server, for example http://localhost:8787 or https://revenuedot.example.com. The examples read REVENUEDOT_URL, PUBLIC_KEY, SECRET_KEY and PROJECT_ID from your shell.

Operations on this page (74)#

• Server: Server name and docs link, Health check, Connectivity probe
• Customer info: Get customer info
• Receipts: Post a purchase or restore
• Offerings (SDK): Get offerings, Get offerings without a user, Test Store product details
• Identity: Log in (identify), Alias two app user ids
• Attributes: Read customer attributes, Set customer attributes
• SDK support: Intro offer eligibility (StoreKit 1), Sign a promotional offer (iOS), Attribution data (deprecated iOS call), Apple AdServices token, SDK health report availability, SDK health report, Product to entitlement mapping (offline entitlements), Customer Center configuration, Customer Center support ticket, Virtual currency balances, Redeem a web purchase, Register an Apple external purchase token (iOS), Rewarded ad verification status, Amazon receipt details, Paywall workflows (web SDK), One paywall workflow (web SDK), Restore eligibility (StoreKit 2), Remote config fallback (none), Remote config: paywalls and UI settings, Download a remote-config blob, SDK paywall, Customer Center and ad events, SDK diagnostics (accepted, not stored)
• Web Billing: Web offering products, Start a hosted web checkout, Web Billing purchase (not available), Prepare a Web Billing checkout (not available), Start a Web Billing checkout (not available), Web Billing checkout status, Refresh Web Billing checkout pricing, Complete a Web Billing checkout, Web checkout branding
• Subscriber tokens: Get customer info (subscriber token), Get offerings (subscriber token), Intro offer eligibility (StoreKit 1) (subscriber token), Attribution data (deprecated iOS call) (subscriber token), Read customer attributes (subscriber token), Set customer attributes (subscriber token), Apple AdServices token (subscriber token), SDK health report (subscriber token), Customer Center configuration (subscriber token), Customer Center support ticket (subscriber token), Virtual currency balances (subscriber token), Restore eligibility (StoreKit 2) (subscriber token), Rewarded ad verification status (subscriber token), Web offering products (subscriber token), Test Store product details (subscriber token), Spend in-app currency as the subscriber
• Auth sign-in: Sign in with an identity provider's ID token, Refresh the access token, Sign out, Refresh the access token, Sign out, Public key of RevenueDot's ID and access tokens
• Store notifications: App Store Server Notifications v2, Google Play real-time developer notifications (Pub/Sub push), Amazon Appstore Real-time Notifications (SNS), Stripe webhooks, Paddle notifications, Roku Pay push notifications, Galaxy Store server notifications, Stripe Connect webhooks (RevenueDot's platform)
• Response signing: Public key for response signatures

Server#

Health and server info. No API key.

Server name and docs link#

GET / · Auth: none

Answers a small JSON document. The Docker health check calls it.

Example request

curl -s "$REVENUEDOT_URL/"

Responses

• 200: Server info.

Example 200 response:

{
  "name": "RevenueDot",
  "docs": "https://revenuedot.app/docs"
}

Health check#

GET /v1/health · Auth: none

Needs no API key. Use it for load balancer and uptime checks.

Example request

curl -s "$REVENUEDOT_URL/v1/health"

Responses

• 200: The server is up.

Example 200 response:

{
  "status": "ok"
}

Connectivity probe#

GET /v1/health/connectivity · Auth: none

Needs no API key. The iOS SDK probes it only with its internal API failover setting, which is off by default.

Example request

curl -s "$REVENUEDOT_URL/v1/health/connectivity"

Responses

• 200: The server is up.

Example 200 response:

{
  "status": "ok"
}

Customer info#

The customer's entitlements, subscriptions and one-time purchases, as the SDK decodes them into CustomerInfo.

Get customer info#

GET /v1/subscribers/{app_user_id} · Auth: public app key or secret key

What Purchases.getCustomerInfo() calls. Creates the customer when the app user id is new (answer 201). With a secret key the answer also has subscriber_attributes. Entitlements are listed even after they expire; an entitlement is active while expires_date is null or in the future.

Path parameters

Headers

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Customer info. Returns CustomerInfo.
• 201: Customer info of a customer created by this call. Returns CustomerInfo.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "request_date": "2026-09-30T20:41:54Z",
  "request_date_ms": 1790800914034,
  "subscriber": {
    "entitlements": {
      "pro": {
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "product_identifier": "pro_monthly",
        "purchase_date": "2026-09-30T20:41:54Z"
      }
    },
    "first_seen": "2026-09-30T20:41:54Z",
    "last_seen": "2026-09-30T20:41:54Z",
    "management_url": null,
    "non_subscriptions": {},
    "original_app_user_id": "user_1",
    "original_application_version": null,
    "original_purchase_date": "2026-09-30T20:41:54Z",
    "other_purchases": {},
    "subscriptions": {
      "pro_monthly": {
        "auto_resume_date": null,
        "billing_issues_detected_at": null,
        "display_name": null,
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "is_sandbox": true,
        "management_url": null,
        "original_purchase_date": "2026-09-30T20:41:54Z",
        "ownership_type": "PURCHASED",
        "period_type": "normal",
        "purchase_date": "2026-09-30T20:41:54Z",
        "refunded_at": null,
        "store": "test_store",
        "store_transaction_id": "test_1790800914000_quickstart",
        "unsubscribe_detected_at": null,
        "price": {
          "amount": 9.99,
          "currency": "USD"
        }
      }
    }
  }
}

Receipts#

Purchases, restores and syncs. RevenueDot verifies them with the store.

Post a purchase or restore#

POST /v1/receipts · Auth: public app key or secret key

Every purchase, restore and syncPurchases() ends here. RevenueDot verifies the purchase with the store, saves it, records events and answers the updated customer info.

• App Store: fetch_token is a StoreKit 2 signed transaction (JWS), a StoreKit 1 app receipt (base64) or an Xcode StoreKit test receipt. With the app's in-app purchase key, Apple's App Store Server API supplies the full history and renewal state.
• Google Play: fetch_token is the purchase token. RevenueDot checks it with the Play Developer API and acknowledges it.
• Amazon Appstore: fetch_token is the receipt id and store_user_id the Amazon user id (X-Platform: amazon). RevenueDot checks both with Amazon's Receipt Verification Service.
• Stripe: from your backend, with X-Platform: stripe and the Stripe app's public key (strp_): fetch_token is a subscription id (sub_…) or a Checkout Session id (cs_…). RevenueDot reads it from Stripe with the app's restricted key. An unpaid first invoice or an open session answers 503, so post it again later.
• Paddle: from your backend, with X-Platform: paddle and the Paddle app's public key (pdl_): fetch_token is a subscription id (sub_…) or a transaction id (txn_…). RevenueDot reads it from Paddle with the app's API key; a checkout that is not finished answers 503. Products are Paddle price ids (pri_…).
• Roku: the Roku SDK posts fetch_token = the Roku transaction id (X-Platform: roku). RevenueDot validates it with Roku Pay's web services, which also supply the price and currency; X-Is-Sandbox: true (a sideloaded channel) records sandbox.
• Galaxy Store: the Android SDK built with purchases-store-galaxy posts fetch_token = Samsung's purchase id with X-Platform: android and the Galaxy app's galx_ key. RevenueDot reads the receipt from Samsung, and a subscription's state with the app's service account; purchased_products tells the SDK which items to consume.
• Test Store: fetch_token is test_<purchase time in ms>_<id>. Any such token is accepted.

4xx or 5xx matters. A 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. RevenueDot answers 5xx for its own and the store's temporary failures so the SDK keeps the purchase and retries. With a secret key, send X-Platform so RevenueDot knows which app the receipt belongs to.

Headers

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/receipts" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1","fetch_token":"test_1790800914000_quickstart","product_id":"pro_monthly","price":9.99,"currency":"USD","presented_offering_identifier":"default"}'

Responses

• 200: Updated customer info, plus purchased_products. Returns ReceiptResponse.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.
• 500: Server error. The SDK keeps the purchase and retries. Returns V1Error.
• 503: The store could not be reached. Retry later. Returns V1Error.

Example 200 response:

{
  "request_date": "2026-09-30T20:41:54Z",
  "request_date_ms": 1790800914034,
  "subscriber": {
    "entitlements": {
      "pro": {
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "product_identifier": "pro_monthly",
        "purchase_date": "2026-09-30T20:41:54Z"
      }
    },
    "first_seen": "2026-09-30T20:41:54Z",
    "last_seen": "2026-09-30T20:41:54Z",
    "management_url": null,
    "non_subscriptions": {},
    "original_app_user_id": "user_1",
    "original_application_version": null,
    "original_purchase_date": "2026-09-30T20:41:54Z",
    "other_purchases": {},
    "subscriptions": {
      "pro_monthly": {
        "auto_resume_date": null,
        "billing_issues_detected_at": null,
        "display_name": null,
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "is_sandbox": true,
        "management_url": null,
        "original_purchase_date": "2026-09-30T20:41:54Z",
        "ownership_type": "PURCHASED",
        "period_type": "normal",
        "purchase_date": "2026-09-30T20:41:54Z",
        "refunded_at": null,
        "store": "test_store",
        "store_transaction_id": "test_1790800914000_quickstart",
        "unsubscribe_detected_at": null,
        "price": {
          "amount": 9.99,
          "currency": "USD"
        }
      }
    }
  },
  "purchased_products": {
    "pro_monthly": {
      "should_consume": false
    }
  }
}

Offerings (SDK)#

What the paywall shows.

Get offerings#

GET /v1/subscribers/{app_user_id}/offerings · Auth: public app key or secret key

What Purchases.getOfferings() calls. Lists active offerings with the packages whose product belongs to the calling app. A new app user id makes the customer here, as GET /v1/subscribers/{app_user_id} does (the SDK sends both at once on a first launch), so the first answer already includes an experiment variant. current_offering_id is the customer's override when one is set. Otherwise RevenueDot resolves, in order: the experiment the customer is in (running or paused), a running experiment that enrolls them now (by priority), the first live targeting rule that matches, the project's current offering. A variant's placements overlay the rule's in placements.offering_ids_by_placement. See Experiments.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/offerings" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Offerings. Returns Offerings.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "current_offering_id": "default",
  "offerings": [
    {
      "description": "Standard plans",
      "identifier": "default",
      "metadata": null,
      "packages": [
        {
          "identifier": "$rc_monthly",
          "platform_product_identifier": "pro_monthly"
        },
        {
          "identifier": "$rc_annual",
          "platform_product_identifier": "pro_annual"
        },
        {
          "identifier": "$rc_lifetime",
          "platform_product_identifier": "pro_lifetime"
        }
      ]
    }
  ]
}

Get offerings without a user#

GET /v1/offerings · Auth: public app key or secret key

Same answer as the per-user call, without a customer override.

Example request

curl -s "$REVENUEDOT_URL/v1/offerings" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Offerings. Returns Offerings.
• 401: Unknown API key. Returns V1Error.

Test Store product details#

GET /rcbilling/v1/subscribers/{app_user_id}/products · Auth: public app key

Product details the SDK needs for Test Store (and web) products, in the web billing products shape. Prices are 0 until the catalog stores Test Store prices.

Path parameters

Query parameters

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/subscribers/user_1/products" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Product details.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "product_details": [
    {
      "identifier": "pro_monthly",
      "product_type": "subscription",
      "title": "Pro monthly",
      "description": null,
      "current_price": {
        "amount": 0,
        "amount_micros": 0,
        "currency": "USD"
      },
      "normal_period_duration": "P1M",
      "default_purchase_option_id": "base",
      "default_subscription_option_id": "base",
      "purchase_options": {
        "base": {
          "id": "base",
          "price_id": "base",
          "base": {
            "period_duration": "P1M",
            "cycle_count": 1,
            "price": {
              "amount": 0,
              "amount_micros": 0,
              "currency": "USD"
            }
          },
          "base_price": null,
          "trial": null,
          "intro_price": null
        }
      },
      "subscription_options": {
        "base": {
          "id": "base",
          "price_id": "base",
          "base": {
            "period_duration": "P1M",
            "cycle_count": 1,
            "price": {
              "amount": 0,
              "amount_micros": 0,
              "currency": "USD"
            }
          },
          "base_price": null,
          "trial": null,
          "intro_price": null
        }
      }
    }
  ]
}

Identity#

logIn and aliases.

Log in (identify)#

POST /v1/subscribers/identify · Auth: public app key or secret key

What Purchases.logIn() calls. When new_app_user_id is new and the current id is anonymous with no other ids, the anonymous customer takes the new id (201). When new_app_user_id exists, an anonymous-only current customer is merged into it (200). See Customers and app user IDs.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/identify" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"$RCAnonymousID:abc123","new_app_user_id":"user_2"}'

Responses

• 200: The user existed. Returns CustomerInfo.
• 201: The user is new. Returns CustomerInfo.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "request_date": "2026-09-30T20:41:54Z",
  "request_date_ms": 1790800914034,
  "subscriber": {
    "entitlements": {
      "pro": {
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "product_identifier": "pro_monthly",
        "purchase_date": "2026-09-30T20:41:54Z"
      }
    },
    "first_seen": "2026-09-30T20:41:54Z",
    "last_seen": "2026-09-30T20:41:54Z",
    "management_url": null,
    "non_subscriptions": {},
    "original_app_user_id": "user_1",
    "original_application_version": null,
    "original_purchase_date": "2026-09-30T20:41:54Z",
    "other_purchases": {},
    "subscriptions": {
      "pro_monthly": {
        "auto_resume_date": null,
        "billing_issues_detected_at": null,
        "display_name": null,
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "is_sandbox": true,
        "management_url": null,
        "original_purchase_date": "2026-09-30T20:41:54Z",
        "ownership_type": "PURCHASED",
        "period_type": "normal",
        "purchase_date": "2026-09-30T20:41:54Z",
        "refunded_at": null,
        "store": "test_store",
        "store_transaction_id": "test_1790800914000_quickstart",
        "unsubscribe_detected_at": null,
        "price": {
          "amount": 9.99,
          "currency": "USD"
        }
      }
    }
  }
}

Alias two app user ids#

POST /v1/subscribers/{app_user_id}/alias · Auth: public app key or secret key

Links new_app_user_id to the customer with the same merge rules as log in. The Android SDK uses it for Block Store recovery.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/alias" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Accepted.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

Attributes#

Customer attributes such as $email.

Read customer attributes#

GET /v1/subscribers/{app_user_id}/attributes · Auth: secret key · RevenueDot extension

The attributes the SDK or your server set, with when each was set. Needs a subscriber access token for this app user id (the app reads its own attributes after an Auth sign-in) or a secret key. An app's public key alone answers 401 with code 7224: attributes can hold an email address or a phone number. An unknown app user id answers an empty object.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/attributes" -H "Authorization: Bearer $SECRET_KEY"

Responses

• 200: The attributes.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "subscriber_attributes": {
    "$displayName": {
      "value": "Ana",
      "updated_at_ms": 1790800914000
    },
    "plan_goal": {
      "value": "sleep",
      "updated_at_ms": 1790800914000
    }
  }
}

Set customer attributes#

POST /v1/subscribers/{app_user_id}/attributes · Auth: public app key or secret key

Saves attributes such as $email, $displayName or your own keys. A null value deletes the attribute, except attribution attributes ($mediaSource, $campaign, $adGroup, $ad, $keyword, $creative, $appleAds*, $claimType, $conversionType): they are write-once, so a stored value is kept and a different value or a null is ignored. Correct them with the REST API v2. An invalid $email is refused with 7263; the other attributes are saved. collectDeviceIdentifiers() sends $ip and $deviceVersion as "true": RevenueDot stores the request's IP address and the device and OS from the SDK's headers instead.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/attributes" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"attributes":{"$email":{"value":"ana@example.com","updated_at_ms":1790800914000}}}'

Responses

• 200: Saved.
• 400: Some attributes were not saved. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

SDK support#

Endpoints the SDK calls for features RevenueDot answers minimally, so the SDK keeps working.

Intro offer eligibility (StoreKit 1)#

POST /v1/subscribers/{app_user_id}/intro_eligibility · Auth: public app key or secret key

Answers null (unknown) for every product, so the SDK decides eligibility on the device.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/intro_eligibility" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Eligibility per product.

Example 200 response:

{
  "pro_monthly": null
}

Sign a promotional offer (iOS)#

POST /v1/offers · Auth: public app key or secret key

What Purchases.promotionalOffer(forProductDiscount:product:) calls. RevenueDot signs each offer with the App Store app's In-App Purchase key (key_id, issuer_id and private_key in the app's credentials) the way Apple verifies it: ECDSA P-256 with SHA-256 over the bundle id, key id, product id, offer id, app account token, nonce and timestamp, DER-encoded and base64 (Apple's format). The app account token matches what the SDK puts on the payment: with StoreKit 2 the lowercase app user id when it is a UUID and empty otherwise; with StoreKit 1 the app user id. Without an In-App Purchase key the answer is 400 with code 7234, which the SDK reports as invalidAppleSubscriptionKeyError for that offer only.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/offers" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1","fetch_token":"…","generate_offers":[{"offer_id":"winback_50","product_id":"pro_monthly"}]}'

Responses

• 200: One signature per offer.
• 400: No In-App Purchase key, or no offers. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "offers": [
    {
      "key_id": "2X9R4HXF34",
      "offer_id": "winback_50",
      "product_id": "pro_monthly",
      "signature_data": {
        "nonce": "0f3c2a8e-5d7b-4d7e-9a53-3b8f2c1e6d40",
        "signature": "MEUCIQDD…",
        "timestamp": 1790800914034
      }
    }
  ]
}

Attribution data (deprecated iOS call)#

POST /v1/subscribers/{app_user_id}/attribution · Auth: public app key or secret key

What the deprecated Purchases.addAttributionData calls. The advertising identifiers in data (rc_idfa, rc_idfv, rc_gps_adid, rc_ip_address) become $idfa, $idfv, $gpsAdId and $ip. For Apple Search Ads (network 0) with iad-attribution true, the iAd fields become $mediaSource ("Apple Search Ads"), $campaign, $adGroup, $keyword, $creative and the $appleAds* ids. Attribution is write-once: a campaign attribute the customer already has is kept.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/attribution" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"network":0,"data":{"rc_idfv":"4CEE1BEE-3C19-4591-9E34-1AD968D7B609","Version3.1":{"iad-attribution":"true","iad-campaign-name":"Spring","iad-keyword":"scanner"}}}'

Responses

• 200: Stored.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

Apple AdServices token#

POST /v1/subscribers/{app_user_id}/adservices_attribution · Auth: public app key or secret key

What enableAdServicesAttributionTokenCollection() sends once per install (the same token can also arrive as aad_attribution_token on a receipt). After answering, RevenueDot looks the token up with Apple's attribution API, retrying a 404 or 5xx 3 times 5 seconds apart, and stores an attributed install as $mediaSource ("Apple Search Ads"), $campaign, $adGroup, $keyword, $ad, $appleAdsCampaignId, $appleAdsAdGroupId, $appleAdsKeywordId, $appleAdsAdId, $appleAdsOrgId, $appleAdsCountryOrRegion, $claimType and $conversionType. Apple returns ids, not names. They show on the customer page and in every webhook's subscriber_attributes.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/adservices_attribution" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"aad_attribution_token":"wD3Ma…"}'

Responses

• 200: Accepted; the lookup runs after the answer.
• 400: No token. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

SDK health report availability#

GET /v1/subscribers/{app_user_id}/health_report_availability · Auth: none

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/health_report_availability"

Responses

• 200: No report logs.

Example 200 response:

{
  "report_logs": false
}

SDK health report#

GET /v1/subscribers/{app_user_id}/health_report · Auth: public app key

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/health_report" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Always passed.

Example 200 response:

{
  "status": "passed",
  "project_id": "proj18pzzkao",
  "app_id": "appvnrm0a5h",
  "checks": []
}

Product to entitlement mapping (offline entitlements)#

GET /v1/product_entitlement_mapping · Auth: public app key or secret key

Lets the SDK grant entitlements on the device while the server answers 5xx (offline entitlements). The SDK fetches it every 25 hours. A public key gets only its own app's products, keyed the way that SDK looks them up: App Store products by product id (product:monthly for a monthly billing plan), Google Play products by subscription:base_plan and by the bare subscription id, which carries every base plan's entitlements because Android purchases do not name their base plan. Consumables are left out. A secret key gets the whole project. See Offline entitlements.

Example request

curl -s "$REVENUEDOT_URL/v1/product_entitlement_mapping" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: The mapping.

Example 200 response:

{
  "product_entitlement_mapping": {
    "pro_monthly": {
      "product_identifier": "pro_monthly",
      "entitlements": [
        "pro"
      ]
    }
  }
}

Customer Center configuration#

GET /v1/customercenter/{app_user_id} · Auth: public app key

The project's Customer Center configuration: appearance, the management and no-active screens with their help paths, localized strings and the support email. A built-in default merged with what the project stored through POST /v2/projects/{project_id}/customer_center_config.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/customercenter/user_1" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: The configuration.

Example 200 response:

{
  "customer_center": {
    "screens": {
      "MANAGEMENT": {
        "type": "MANAGEMENT",
        "title": "Manage subscription",
        "paths": []
      }
    },
    "support": {
      "email": "support@example.com"
    }
  }
}

Customer Center support ticket#

POST /v1/customercenter/support/create-ticket · Auth: public app key

Stores the ticket, emails the Customer Center support address (Reply-To the customer) and lists it under Lifecycle > Support. sent is false when ticket creation is off (support.support_tickets.allow_creation), a field is missing or invalid, or the customer sent more than 5 tickets in an hour; the SDK then offers its email link.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customercenter/support/create-ticket" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1234","customer_email":"wren@example.com","issue_description":"My scans are not syncing."}'

Responses

• 200: Whether the ticket was taken.

Example 200 response:

{
  "sent": true
}

Virtual currency balances#

GET /v1/subscribers/{app_user_id}/virtual_currencies · Auth: public app key

The customer's in-app currency balances by code. A customer the server has not seen has none.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/virtual_currencies" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Balances.

Example 200 response:

{
  "virtual_currencies": {
    "GLD": {
      "balance": 700,
      "name": "Gold",
      "code": "GLD",
      "description": null
    }
  }
}

Redeem a web purchase#

POST /v1/subscribers/redeem_purchase · Auth: public app key

What Purchases.redeemWebPurchase() calls with the redemption_token from a redemption link (<scheme>://redeem_web_purchase?redemption_token=rdrt_...). The anonymous customer who paid on RevenueDot's web checkout is merged into this app user id, like logIn: their purchases and attributes move over. The answer is the customer info, and PURCHASE_REDEEMED is sent once. See Redemption links.

• 200: redeemed, or already redeemed by this customer (a retry is safe).
• 400 · 7849: the token is unknown, malformed or from another project. The SDK returns invalidToken.
• 400 · 7852: another customer redeemed it. The SDK returns purchaseBelongsToOtherUser.
• 400 · 7853: the link expired (after the web config's redemption_link_hours, default 24). purchase_redemption_error_info.obfuscated_email says where a new link goes; it is emailed at most once an hour. The SDK returns expired with that email.

Headers

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/redeem_purchase" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1","redemption_token":"rdrt_q8Xc2kP0vN5mZ7tL1sW9hB3yR6dF4gJ2aE0uI8oK1nM"}'

Responses

• 200: Customer info with the web purchase. Returns CustomerInfo.
• 400: The token cannot be redeemed.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "request_date": "2026-09-30T20:41:54Z",
  "request_date_ms": 1790800914034,
  "subscriber": {
    "entitlements": {
      "pro": {
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "product_identifier": "pro_monthly",
        "purchase_date": "2026-09-30T20:41:54Z"
      }
    },
    "first_seen": "2026-09-30T20:41:54Z",
    "last_seen": "2026-09-30T20:41:54Z",
    "management_url": null,
    "non_subscriptions": {},
    "original_app_user_id": "user_1",
    "original_application_version": null,
    "original_purchase_date": "2026-09-30T20:41:54Z",
    "other_purchases": {},
    "subscriptions": {
      "pro_monthly": {
        "auto_resume_date": null,
        "billing_issues_detected_at": null,
        "display_name": null,
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "is_sandbox": true,
        "management_url": null,
        "original_purchase_date": "2026-09-30T20:41:54Z",
        "ownership_type": "PURCHASED",
        "period_type": "normal",
        "purchase_date": "2026-09-30T20:41:54Z",
        "refunded_at": null,
        "store": "test_store",
        "store_transaction_id": "test_1790800914000_quickstart",
        "unsubscribe_detected_at": null,
        "price": {
          "amount": 9.99,
          "currency": "USD"
        }
      }
    }
  }
}

Register an Apple external purchase token (iOS)#

POST /v1/external_purchase_tokens · Auth: public app key

Part of Apple's external purchase and link-out flows, before a web checkout. The token is acknowledged with an id, which is all the SDK reads. The web checkout that follows is /rcbilling/v1/hosted-checkout.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/external_purchase_tokens" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Registered.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "id": "ept3b1f0c9e2d8a4f6b9c7e5d3a1b2c4d6e",
  "purchase_type": "LINK_OUT",
  "is_sandbox": true,
  "token_source": "APPLE_SDK"
}

Rewarded ad verification status#

GET /v1/subscribers/{app_user_id}/ads/reward_verifications/{client_transaction_id} · Auth: public app key

What pollRewardVerification polls after the ad's reward callback fires (up to 10 times, about a second apart). The ad network's server-side callback (GET /v1/ads/admob/ssv) records the reward; the first matching reward rule grants it. See Ads: rewarded ads.

• pending: no callback recorded yet for this id, or the grant is still being made. The SDK asks again.
• verified: reward is the first granted reward and more_rewards the rest. reward is null when no rule matched: verified, nothing granted. The SDK then refreshes the customer's balances and customer info.
• failed: failure_reason is user_mismatch (the reward belongs to another customer), missing_user (the callback had no user id) or grant_failed (the rule names a currency or entitlement that no longer exists).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/ads/reward_verifications/$CLIENT_TRANSACTION_ID" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: The verification status.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "status": "verified",
  "reward": {
    "type": "virtual_currency",
    "code": "GEMS",
    "amount": 10
  },
  "more_rewards": []
}

Amazon receipt details#

GET /v1/receipts/amazon/{store_user_id}/{receipt_id} · Auth: public app key

The Android SDK built for Amazon asks for it on subscription purchases and reads termSku, which it then posts as the product id. RevenueDot asks Amazon's Receipt Verification Service with the app's shared key and answers Amazon's receipt unchanged.

• 400 · 7103: Amazon does not know the receipt or the user. 400 · 7662: the key is not an Amazon app's.
• 500 · 7101: no shared key is saved, or Amazon rejected it. 503 · 7101: Amazon is unavailable; the SDK keeps the purchase unconsumed and retries. See Amazon Appstore setup.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/receipts/amazon/$STORE_USER_ID/$RECEIPT_ID" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Amazon's receipt.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.
• 500: Server error. The SDK keeps the purchase and retries. Returns V1Error.
• 503: The store could not be reached. Retry later. Returns V1Error.

Example 200 response:

{
  "autoRenewing": true,
  "betaProduct": false,
  "cancelDate": null,
  "cancelReason": null,
  "countryCode": "US",
  "freeTrialEndDate": null,
  "gracePeriodEndDate": null,
  "productId": "pro.subscription",
  "productType": "SUBSCRIPTION",
  "purchaseDate": 1790800914000,
  "receiptId": "q1YqVrJSSs7P1UvMTazKz9PLTCwoTswtyEktM8jLz0kpLQ1JTSlFMsjILCoQ:3:11",
  "renewalDate": 1793392914000,
  "term": "1 Month",
  "termSku": "pro.monthly",
  "testTransaction": false
}

Paywall workflows (web SDK)#

GET /v1/subscribers/{app_user_id}/workflows · Auth: public app key

What purchases-js presentPaywall asks first. There are no workflows, so the SDK uses the offering's own paywall.

Path parameters

Query parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/workflows" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: No workflows.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "workflows": [],
  "ui_config": {}
}

One paywall workflow (web SDK)#

GET /v1/subscribers/{app_user_id}/workflows/{workflow_id} · Auth: public app key

Never called, because the workflow list is empty.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/subscribers/user_1/workflows/$WORKFLOW_ID" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 401: Unknown API key. Returns V1Error.
• 404: No such workflow. Returns V1Error.

Restore eligibility (StoreKit 2)#

POST /v1/subscribers/{app_user_id}/restore/eligibility · Auth: public app key

Path parameters

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/subscribers/user_1/restore/eligibility" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Always allowed.

Example 200 response:

{
  "is_purchase_allowed_by_restore_behavior": true
}

Remote config fallback (none)#

GET /v1/config/{domain} · Auth: public app key

The SDK's JSON fallback host path, never used with a proxy URL. Answers 204.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/config/app" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 204: No config.

Remote config: paywalls and UI settings#

POST /v1/config/{domain} · Auth: public app key

How current SDKs (iOS 5.83 and later) load paywalls. The body is an RC Container (application/x-rc-format): an 8-byte header ("RC", version 1), then elements of checksum (24 bytes, the first 24 bytes of SHA-256 of the payload), size (u32, little-endian), encoding (0, none) and 3 reserved bytes, then the payload padded to 8 bytes. Element 0 is the configuration JSON with the topics sources, ui_config (app, localizations, variable_config, custom_variables) and workflows (one per published paywall, keyed by workflow id, with offering_identifier). The other elements are the blobs those topics reference, inline. 204 when the manifest the SDK sent is current.

Path parameters

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/config/app" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"manifest":"v1.Qm9vdHN0cmFw","prefetched_blobs":[]}'

Responses

• 200: RC Container.
• 204: The SDK's configuration is current.

Download a remote-config blob#

GET /blobs/{blob_ref} · Auth: none

Public and immutable. The SDK downloads a blob here when it was not inline in the container (the sources topic points here).

Path parameters

Example request

curl -s "$REVENUEDOT_URL/blobs/$BLOB_REF"

Responses

• 200: The blob (JSON).
• 404: Unknown blob.

SDK paywall, Customer Center and ad events#

POST /v1/events · Auth: public app key

Stored for the paywall, ad and Customer Center charts and the Ads Overview (each SDK event id once). Ad events are the rc_ads_* types. A malformed batch is still answered 200 so the SDK does not resend it forever.

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/events" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Accepted.

Example 200 response:

{}

SDK diagnostics (accepted, not stored)#

POST /v1/diagnostics · Auth: public app key

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/diagnostics" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Accepted.

Example 200 response:

{}

Web Billing#

Web checkout calls from the iOS SDK and purchases-js. The iOS SDK's paywall web checkout opens a Stripe Checkout on your own Stripe account (web billing). The purchases-js checkout for RevenueCat Billing (rcb_ keys, Stripe Elements inside the SDK) is not available and answers an error the SDK shows as a failed purchase.

Web offering products#

GET /rcbilling/v1/subscribers/{app_user_id}/offering_products · Auth: public app key

Defined in the iOS SDK with no caller. There are no web offerings.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/subscribers/user_1/offering_products" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: No web offerings.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "offerings": {}
}

Start a hosted web checkout#

POST /rcbilling/v1/hosted-checkout · Auth: public app key

The iOS SDK's paywall web checkout. RevenueDot finds the package in the offering, picks the project's Stripe app that sells it as a web product, and creates a Stripe Checkout Session for this app user id with that app's key. The SDK opens checkout_url and closes it when the browser reaches success_url or cancel_url; the success page records the purchase, so the customer info has it at once. See Sell on the web with Stripe.

• 400 · 7000: the offering or package is unknown, or the package has no web product.
• 503 · 7101: Stripe is unavailable or refused the key.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/rcbilling/v1/hosted-checkout" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1","package_id":"$rc_monthly","presented_offering_identifier":"web"}'

Responses

• 200: The checkout.
• 400: No web product for this package. Returns V1Error.
• 401: Unknown API key. Returns V1Error.
• 503: The store could not be reached. Retry later. Returns V1Error.

Example 200 response:

{
  "operation_session_id": "wco_8k2m9q4x7a1b3c5d",
  "checkout_url": "https://checkout.stripe.com/c/pay/cs_test_a1B2c3D4",
  "success_url": "https://api.revenuedot.app/pay/scanner/_/success",
  "cancel_url": "https://api.revenuedot.app/pay/scanner/_/cancel"
}

Web Billing purchase (not available)#

POST /rcbilling/v1/purchase · Auth: public app key

Defined in purchases-js with no caller. 400 with code 7000.

Example request

curl -s -X POST "$REVENUEDOT_URL/rcbilling/v1/purchase" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: Not available. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Prepare a Web Billing checkout (not available)#

POST /rcbilling/v1/checkout/prepare · Auth: public app key

purchases-js with an rcb_ key. 400 with code 7000: the purchase fails with an error in the SDK's purchase screen.

Example request

curl -s -X POST "$REVENUEDOT_URL/rcbilling/v1/checkout/prepare" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: Not available. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Start a Web Billing checkout (not available)#

POST /rcbilling/v1/checkout/start · Auth: public app key

Example request

curl -s -X POST "$REVENUEDOT_URL/rcbilling/v1/checkout/start" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: Not available. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Web Billing checkout status#

GET /rcbilling/v1/checkout/{operation_session_id} · Auth: public app key

No checkout session exists: 400 with code 7877.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/checkout/$OPERATION_SESSION_ID" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: No such session. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Refresh Web Billing checkout pricing#

PATCH /rcbilling/v1/checkout/{operation_session_id} · Auth: public app key

Path parameters

Example request

curl -s -X PATCH "$REVENUEDOT_URL/rcbilling/v1/checkout/$OPERATION_SESSION_ID" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: No such session. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Complete a Web Billing checkout#

POST /rcbilling/v1/checkout/{operation_session_id}/complete · Auth: public app key

Path parameters

Example request

curl -s -X POST "$REVENUEDOT_URL/rcbilling/v1/checkout/$OPERATION_SESSION_ID/complete" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 400: No such session. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Web checkout branding#

GET /rcbilling/v1/branding · Auth: public app key

purchases-js with an rcb_ key loads it before a checkout: the app's name and the SDK's default look.

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/branding" -H "Authorization: Bearer $PUBLIC_KEY"

Responses

• 200: Branding.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "id": "appvnrm0a5h",
  "app_name": "Scanner Web",
  "app_icon": null,
  "app_icon_webp": null,
  "app_wordmark": null,
  "app_wordmark_webp": null,
  "appearance": null,
  "support_email": null,
  "gateway_tax_collection_enabled": false,
  "brand_font_config": null
}

Subscriber tokens#

The SDK endpoints for one customer, authorized by a subscriber access token from POST /v2/projects/{project_id}/apps/{app_id}/authenticate instead of the app key. The RevenueCat SDKs call these paths in their internal token mode.

Get customer info (subscriber token)#

GET /v1/customer · Auth: none

The subscriber-token form of GET /v1/subscribers/{app_user_id}: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Headers

Example request

curl -s "$REVENUEDOT_URL/v1/customer"

Responses

• 200: Customer info. Returns CustomerInfo.
• 201: Customer info of a customer created by this call. Returns CustomerInfo.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "request_date": "2026-09-30T20:41:54Z",
  "request_date_ms": 1790800914034,
  "subscriber": {
    "entitlements": {
      "pro": {
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "product_identifier": "pro_monthly",
        "purchase_date": "2026-09-30T20:41:54Z"
      }
    },
    "first_seen": "2026-09-30T20:41:54Z",
    "last_seen": "2026-09-30T20:41:54Z",
    "management_url": null,
    "non_subscriptions": {},
    "original_app_user_id": "user_1",
    "original_application_version": null,
    "original_purchase_date": "2026-09-30T20:41:54Z",
    "other_purchases": {},
    "subscriptions": {
      "pro_monthly": {
        "auto_resume_date": null,
        "billing_issues_detected_at": null,
        "display_name": null,
        "expires_date": "2026-10-30T20:41:54Z",
        "grace_period_expires_date": null,
        "is_sandbox": true,
        "management_url": null,
        "original_purchase_date": "2026-09-30T20:41:54Z",
        "ownership_type": "PURCHASED",
        "period_type": "normal",
        "purchase_date": "2026-09-30T20:41:54Z",
        "refunded_at": null,
        "store": "test_store",
        "store_transaction_id": "test_1790800914000_quickstart",
        "unsubscribe_detected_at": null,
        "price": {
          "amount": 9.99,
          "currency": "USD"
        }
      }
    }
  }
}

Get offerings (subscriber token)#

GET /v1/customer/offerings · Auth: none

The subscriber-token form of GET /v1/subscribers/{app_user_id}/offerings: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/v1/customer/offerings"

Responses

• 200: Offerings. Returns Offerings.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "current_offering_id": "default",
  "offerings": [
    {
      "description": "Standard plans",
      "identifier": "default",
      "metadata": null,
      "packages": [
        {
          "identifier": "$rc_monthly",
          "platform_product_identifier": "pro_monthly"
        },
        {
          "identifier": "$rc_annual",
          "platform_product_identifier": "pro_annual"
        },
        {
          "identifier": "$rc_lifetime",
          "platform_product_identifier": "pro_lifetime"
        }
      ]
    }
  ]
}

Intro offer eligibility (StoreKit 1) (subscriber token)#

POST /v1/customer/intro_eligibility · Auth: none

The subscriber-token form of POST /v1/subscribers/{app_user_id}/intro_eligibility: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/intro_eligibility"

Responses

• 200: Eligibility per product.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "pro_monthly": null
}

Attribution data (deprecated iOS call) (subscriber token)#

POST /v1/customer/attribution · Auth: none

The subscriber-token form of POST /v1/subscribers/{app_user_id}/attribution: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/attribution" \
  -H "Content-Type: application/json" -d '{"network":0,"data":{"rc_idfv":"4CEE1BEE-3C19-4591-9E34-1AD968D7B609","Version3.1":{"iad-attribution":"true","iad-campaign-name":"Spring","iad-keyword":"scanner"}}}'

Responses

• 200: Stored.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

Read customer attributes (subscriber token)#

GET /v1/customer/attributes · Auth: none · RevenueDot extension

The subscriber-token form of GET /v1/subscribers/{app_user_id}/attributes: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/v1/customer/attributes"

Responses

• 200: The attributes.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "subscriber_attributes": {
    "$displayName": {
      "value": "Ana",
      "updated_at_ms": 1790800914000
    },
    "plan_goal": {
      "value": "sleep",
      "updated_at_ms": 1790800914000
    }
  }
}

Set customer attributes (subscriber token)#

POST /v1/customer/attributes · Auth: none

The subscriber-token form of POST /v1/subscribers/{app_user_id}/attributes: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/attributes" \
  -H "Content-Type: application/json" -d '{"attributes":{"$email":{"value":"ana@example.com","updated_at_ms":1790800914000}}}'

Responses

• 200: Saved.
• 400: Some attributes were not saved. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

Apple AdServices token (subscriber token)#

POST /v1/customer/adservices_attribution · Auth: none

The subscriber-token form of POST /v1/subscribers/{app_user_id}/adservices_attribution: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/adservices_attribution" \
  -H "Content-Type: application/json" -d '{"aad_attribution_token":"wD3Ma…"}'

Responses

• 200: Accepted; the lookup runs after the answer.
• 400: No token. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{}

SDK health report (subscriber token)#

GET /v1/customer/health_report · Auth: none

The subscriber-token form of GET /v1/subscribers/{app_user_id}/health_report: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/v1/customer/health_report"

Responses

• 200: Always passed.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "status": "passed",
  "project_id": "proj18pzzkao",
  "app_id": "appvnrm0a5h",
  "checks": []
}

Customer Center configuration (subscriber token)#

GET /v1/customer/customercenter · Auth: none

The subscriber-token form of GET /v1/customercenter/{app_user_id}: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/v1/customer/customercenter"

Responses

• 200: The configuration.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "customer_center": {
    "screens": {
      "MANAGEMENT": {
        "type": "MANAGEMENT",
        "title": "Manage subscription",
        "paths": []
      }
    },
    "support": {
      "email": "support@example.com"
    }
  }
}

Customer Center support ticket (subscriber token)#

POST /v1/customer/customercenter/support/create-ticket · Auth: none

The subscriber-token form of POST /v1/customercenter/support/create-ticket: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/customercenter/support/create-ticket" \
  -H "Content-Type: application/json" -d '{"app_user_id":"user_1234","customer_email":"wren@example.com","issue_description":"My scans are not syncing."}'

Responses

• 200: Whether the ticket was taken.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "sent": true
}

Virtual currency balances (subscriber token)#

GET /v1/customer/virtual_currencies · Auth: none

The subscriber-token form of GET /v1/subscribers/{app_user_id}/virtual_currencies: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/v1/customer/virtual_currencies"

Responses

• 200: Balances.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "virtual_currencies": {
    "GLD": {
      "balance": 700,
      "name": "Gold",
      "code": "GLD",
      "description": null
    }
  }
}

Restore eligibility (StoreKit 2) (subscriber token)#

POST /v1/customer/restore/eligibility · Auth: none

The subscriber-token form of POST /v1/subscribers/{app_user_id}/restore/eligibility: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/restore/eligibility"

Responses

• 200: Always allowed.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "is_purchase_allowed_by_restore_behavior": true
}

Rewarded ad verification status (subscriber token)#

GET /v1/customer/ads/reward_verifications/{client_transaction_id} · Auth: none

The subscriber-token form of GET /v1/subscribers/{app_user_id}/ads/reward_verifications/{client_transaction_id}: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Path parameters

Example request

curl -s "$REVENUEDOT_URL/v1/customer/ads/reward_verifications/$CLIENT_TRANSACTION_ID"

Responses

• 200: The verification status.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "status": "verified",
  "reward": {
    "type": "virtual_currency",
    "code": "GEMS",
    "amount": 10
  },
  "more_rewards": []
}

Web offering products (subscriber token)#

GET /rcbilling/v1/customer/offering_products · Auth: none

The subscriber-token form of GET /rcbilling/v1/subscribers/{app_user_id}/offering_products: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/customer/offering_products"

Responses

• 200: No web offerings.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "offerings": {}
}

Test Store product details (subscriber token)#

GET /rcbilling/v1/customer/products · Auth: none

The subscriber-token form of GET /rcbilling/v1/subscribers/{app_user_id}/products: same body and answer, for the app user id of the token. An app key, an expired token or another user's token answers 401 with code 7224.

Query parameters

Example request

curl -s "$REVENUEDOT_URL/rcbilling/v1/customer/products"

Responses

• 200: Product details.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "product_details": [
    {
      "identifier": "pro_monthly",
      "product_type": "subscription",
      "title": "Pro monthly",
      "description": null,
      "current_price": {
        "amount": 0,
        "amount_micros": 0,
        "currency": "USD"
      },
      "normal_period_duration": "P1M",
      "default_purchase_option_id": "base",
      "default_subscription_option_id": "base",
      "purchase_options": {
        "base": {
          "id": "base",
          "price_id": "base",
          "base": {
            "period_duration": "P1M",
            "cycle_count": 1,
            "price": {
              "amount": 0,
              "amount_micros": 0,
              "currency": "USD"
            }
          },
          "base_price": null,
          "trial": null,
          "intro_price": null
        }
      },
      "subscription_options": {
        "base": {
          "id": "base",
          "price_id": "base",
          "base": {
            "period_duration": "P1M",
            "cycle_count": 1,
            "price": {
              "amount": 0,
              "amount_micros": 0,
              "currency": "USD"
            }
          },
          "base_price": null,
          "trial": null,
          "intro_price": null
        }
      }
    }
  ]
}

Spend in-app currency as the subscriber#

POST /v1/customer/virtual_currencies/spend · Auth: none

Takes the amounts off the subscriber's balances, all or nothing. A balance cannot go below zero (422, code 7000); an unknown currency or a malformed body is 400 with code 7226. No webhook is sent, as for balance changes through the API.

Headers

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/customer/virtual_currencies/spend" \
  -H "Content-Type: application/json" -d '{"adjustments":{"GLD":5},"reference":"sword"}'

Responses

• 200: The balances after the spend.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.
• 422: The request is valid but cannot be done in this state. Returns V1Error.

Example 200 response:

{
  "virtual_currencies": {
    "GLD": {
      "balance": 95,
      "name": "Gold",
      "code": "GLD",
      "description": null
    }
  }
}

Auth sign-in#

Sign app users in with a Firebase or OpenID Connect ID token and get a subscriber access token for the /v1/customer/* paths, in the wire format of the RevenueCat SDKs' token login. See Auth.

Sign in with an identity provider's ID token#

POST /v1/auth/login · Auth: public app key · RevenueDot extension

For apps without their own backend (Auth): the app sends the ID token its identity provider gave it, with its public SDK key. RevenueDot verifies the token with the provider's published keys, maps it to an app user id (the first sign-in creates the link; later ones reuse it), merges an anonymous link_to_id like logIn, and returns tokens. The RevenueCat SDKs' token login sends the same body to POST /auth/login. CORS is open, for web apps.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/auth/login" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"method":"firebase","scope":"openid offline_access","id_token":"eyJhbGciOiJSUzI1NiIsImtpZCI6…","link_to_id":"$RCAnonymousID:9f3c1a0e2b7d4c5a8e6f1b2d3c4a5e6f"}'

Responses

• 200: Signed in.
• 400: Malformed body (7226). Returns V1Error.
• 401: The SDK key is unknown (7225) or the ID token fails verification (7224). Returns V1Error.
• 403: Auth is off, or no enabled provider answers this method (7224). Returns V1Error.
• 503: The provider's keys could not be loaded, or the server has no key to sign tokens with. Retry. Returns V1Error.

Example 200 response:

{
  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6ImF0K2p3dCIsImtpZCI6IjNmMmMxYTlkMGU4YjRjNzEifQ.eyJpc3MiOiJodHRwczovL2FwaS5yZXZlbnVlZG90LmFwcCIsInN1YiI6IlhrMmY5UXBMMGFaIiwicmMuYXBwX3VzZXJfaWQiOiJYazJmOVFwTDBhWiIsImFtciI6WyJmaXJlYmFzZSJdfQ.…",
  "refresh_token": "rdrf_9b0c…",
  "id_token": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.…",
  "scope": "openid offline_access",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Refresh the access token#

POST /v1/auth/token · Auth: public app key · RevenueDot extension

The refresh token is replaced: the old one stops working, and using it again answers 401 with 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/auth/token" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"grant_type":"refresh_token","refresh_token":"rdrf_9b0c…"}'

Responses

• 200: New tokens.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6ImF0K2p3dCIsImtpZCI6IjNmMmMxYTlkMGU4YjRjNzEifQ.eyJpc3MiOiJodHRwczovL2FwaS5yZXZlbnVlZG90LmFwcCIsInN1YiI6IlhrMmY5UXBMMGFaIiwicmMuYXBwX3VzZXJfaWQiOiJYazJmOVFwTDBhWiIsImFtciI6WyJmaXJlYmFzZSJdfQ.…",
  "refresh_token": "rdrf_9b0c…",
  "id_token": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.…",
  "scope": "openid offline_access",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Sign out#

POST /v1/auth/revoke · Auth: public app key · RevenueDot extension

A refresh token ends its session and every access token it issued; an access token (token_type_hint: access_token) stops working alone. An unknown token is not an error (RFC 7009).

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/v1/auth/revoke" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"token":"rdrf_9b0c…","token_type_hint":"refresh_token"}'

Responses

• 200: Done.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Refresh the access token#

POST /auth/token · Auth: public app key · RevenueDot extension

The refresh token is replaced: the old one stops working, and using it again answers 401 with 7224.

Request body (application/json)

Example request

curl -s -X POST "$REVENUEDOT_URL/auth/token" -H "Authorization: Bearer $PUBLIC_KEY" \
  -H "Content-Type: application/json" -d '{"grant_type":"refresh_token","refresh_token":"rdrf_9b0c…"}'

Responses

• 200: New tokens.
• 400: Bad request. For receipts, a 4xx tells the SDK the purchase can never be accepted, so it finishes the transaction. Returns V1Error.
• 401: Unknown API key. Returns V1Error.

Example 200 response:

{
  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6ImF0K2p3dCIsImtpZCI6IjNmMmMxYTlkMGU4YjRjNzEifQ.eyJpc3MiOiJodHRwczovL2FwaS5yZXZlbnVlZG90LmFwcCIsInN1YiI6IlhrMmY5UXBMMGFaIiwicmMuYXBwX3VzZXJfaWQiOiJYazJmOVFwTDBhWiIsImFtciI6WyJmaXJlYmFzZSJdfQ.…",
  "refresh_token": "rdrf_9b0c…",
  "id_token": "eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9.…",
  "scope": "openid offline_access",
  "expires_in": 3600,
  "token_type": "Bearer"
}