Accounts and customers

Routes

Method	Route	Permission	Since
POST	/auth/token	Public	1.1.0
DELETE	/auth/token	Signed in	1.1.0
POST	/auth/register	Public	1.5.0
POST	/auth/reset-password	Public	1.5.0
GET	/auth/me	Signed in	1.1.0
PUT, PATCH	/auth/me	Signed in	1.5.0
GET	/users/me/orders	Signed in	1.5.0
GET, POST	/users/me/addresses	Signed in	1.9.0
DELETE	/users/me/addresses/{index}	Signed in	1.9.0

Sign in and sign out

POST /auth/token takes username (username or email) and password, and responds 201 with token, token_type, expires_at and the user object. See Bearer token.

Errors: 401 notiwoo_invalid_credentials. The message is the same whether the user does not exist or the password is wrong.

DELETE /auth/token revokes the request's token and responds { "revoked": true }. If the request did not use a token, it responds 404 notiwoo_token_not_found.

User object

{
  "id": 42,
  "username": "cliente@example.test",
  "email": "cliente@example.test",
  "display_name": "Ana Pérez",
  "first_name": "Ana",
  "last_name": "Pérez",
  "roles": ["customer"],
  "billing": { "first_name": "", "last_name": "", "address_1": "", "address_2": "", "city": "", "state": "", "postcode": "", "phone": "", "country": "CO" },
  "capabilities": { "manage_woocommerce": false, "edit_posts": false, "read": true }
}

Use capabilities.manage_woocommerce to know whether the user can use the management routes.

Register a customer

POST /auth/register

Field	Type	Required	Notes
email	string	Yes	Also used as the username.
password	string	Yes	At least 8 characters.
first_name, last_name, phone	string	No	Stored in the billing details.

Creates a user with the customer role and responds 201 with a token, just like /auth/token.

Errors: 400 notiwoo_invalid_email, 400 notiwoo_weak_password, 409 notiwoo_user_exists.

Reset the password

POST /auth/reset-password with { "email": "..." }. It always responds 200 with a message, whether or not the account exists, so it does not reveal which emails are registered. If the account exists, WordPress sends its reset email.

Profile

GET /auth/me returns the user object.

PUT /auth/me updates only the fields sent: first_name, last_name, display_name, address_1 (alias address), address_2, city, state, postcode, phone and country. First and last name are stored on the WordPress user; the rest, in the billing details. It responds with the updated user.

curl -X PUT https://tienda.example.test/wp-json/notiwoo/v1/auth/me \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"phone": "+57 300 000 0000", "city": "Bogotá"}'

Customer orders

GET /users/me/orders lists the authenticated user's orders.

Parameter	Notes
page, per_page	Standard pagination.
status	One or more comma-separated statuses, with or without the wc- prefix. All by default.

Each order has the WooCommerce structure (id, status, total, billing, line_items…) plus status_nice (readable status), order_type_slug and order_type (service mode).

Saved addresses

GET /users/me/addresses responds { "addresses": [...], "count": 1 }.

POST /users/me/addresses saves an address only if it is within delivery coverage:

Field	Required
address	Yes
city	Yes
postcode, doorbell (apartment, doorbell), first_name, last_name	No

The country is always the store's country.

curl -X POST https://tienda.example.test/wp-json/notiwoo/v1/users/me/addresses \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"address": "Calle 10 # 20-30", "city": "Bogotá", "postcode": "110111", "doorbell": "Apto 402"}'

• Covered: 201 with deliverable: true, the saved address, the check result (check: distance and fee) and the full list.
• Not covered: 200 with deliverable: false and reason. Nothing is saved.
• Missing data: 422 notiwoo_missing_address_fields.

DELETE /users/me/addresses/{index} deletes by position, starting at 0, and returns the reindexed list. If the position does not exist, it responds 404 notiwoo_address_not_found.