> ## Documentation Index > Fetch the complete documentation index at: https://spreecommerce.org/docs/llms.txt > Use this file to discover all available pages before exploring further. # Current user > The signed-in user, the sellers they may act for, and what they may do on the selected one. This is the one authenticated endpoint that answers without `X-Spree-Seller-Id` — it is what tells the panel which seller to name. Sending the header narrows `permission_keys` and `permissions` to that seller; without it both are empty, because capability is per seller and there is no answer spanning all of them. ## OpenAPI ````yaml /api-reference/seller.yaml get /api/v3/seller/me openapi: 3.0.3 info: title: Seller API contact: name: Spree Commerce url: https://spreecommerce.org email: hello@spreecommerce.org description: | Spree Seller API v3 - the marketplace seller panel, where a seller runs their own shop inside someone else's marketplace. This is a branch of its own, not a narrowing of the Admin API. Every endpoint is scoped server-side to the seller the request acts as, which is what makes cross-seller access impossible by construction rather than by rule. Sellers never call the Admin API. ## Authentication Sign in at `POST /api/v3/seller/auth/login` and send the returned JWT as `Authorization: Bearer `. The token carries a `seller_api` audience — a token minted for the storefront or the back office is not accepted here, and vice versa. There is deliberately **no secret API key** for this branch: a credential that could act as a seller without a seller signing in is exactly what the separate audience exists to prevent. ### Choosing a seller A user may run more than one seller. Login returns the list; send the chosen seller's ID in the `X-Spree-Seller-Id` header on every authenticated request. The store is derived from the seller — never sent — so no header can widen what a seller reaches. A request that names no seller the caller belongs to is rejected with `403`. ## Response Format All responses are JSON. List endpoints return paginated responses with `data` and `meta` keys. ## Error Handling Errors return a consistent format: ```json { "error": { "code": "validation_error", "message": "Validation failed", "details": { "name": ["can't be blank"] } } } ``` version: v3 servers: - url: http://{defaultHost} variables: defaultHost: default: localhost:3000 security: [] tags: - name: Authentication description: Seller sign-in, token refresh, logout, and invitation acceptance - name: Account description: The signed-in user, the sellers they may act for, and what they may do - name: Countries description: Country and state reference data for the panel's address forms - name: Delivery Methods description: >- The seller's own ways to ship, and the marketplace methods shared with them - name: Delivery Profiles description: >- The marketplace's delivery vocabulary — what kind of goods a product is, which decides how it ships - name: Delivery Zones description: >- The marketplace's destinations, for narrowing where a seller's own method ships - name: Onboarding description: >- The marketplace checklist a seller completes before admission, and what they submit against it - name: Policies description: The seller's own legal documents, as the marketplace asks them to publish - name: Product Types description: The types a seller may list a product against, and what each adds - name: Products description: The seller's own catalog - name: Profile description: >- The seller's own record — presentation, contact details, addresses, and tax registration - name: Stock Locations description: Where the seller keeps stock, and so where their returns are sent - name: Team description: Who runs this seller, and the invitations nobody has accepted yet - name: Uploads description: Presigned direct uploads for the documents onboarding asks for paths: /api/v3/seller/me: get: tags: - Account summary: Current user description: > The signed-in user, the sellers they may act for, and what they may do on the selected one. This is the one authenticated endpoint that answers without `X-Spree-Seller-Id` — it is what tells the panel which seller to name. Sending the header narrows `permission_keys` and `permissions` to that seller; without it both are empty, because capability is per seller and there is no answer spanning all of them. parameters: - name: X-Spree-Seller-Id in: header required: false description: >- The seller to report capability for. Omit to list sellers without narrowing permissions. schema: type: string responses: '200': description: current user returned content: application/json: example: user: id: adm_UkLWZg9DAJ email: johnny_feest@hodkiewicz.ca first_name: Nadia last_name: Effertz full_name: Nadia Effertz created_at: '2026-01-15T12:00:00.000Z' avatar_url: null sellers: - id: sel_UkLWZg9DAJ name: Seller 53 slug: seller-53 status: approved permissions: - allow: true actions: - read subjects: - Spree::Country has_conditions: false - allow: true actions: - read subjects: - Spree::State has_conditions: false - allow: true actions: - read subjects: - Spree::Store has_conditions: true - allow: true actions: - read - admin subjects: - Spree::Product has_conditions: false - allow: true actions: - read - admin subjects: - Spree::Variant has_conditions: false - allow: true actions: - read - admin subjects: - Spree::OptionType has_conditions: false - allow: true actions: - read - admin subjects: - Spree::OptionValue has_conditions: false - allow: true actions: - read - admin subjects: - Spree::Price has_conditions: false - allow: true actions: - read - admin subjects: - Spree::PriceList has_conditions: false - allow: true actions: - read - admin subjects: - Spree::PriceRule has_conditions: false - allow: true actions: - read - admin subjects: - Spree::Catalog has_conditions: false - allow: true actions: - read - admin subjects: - Spree::CatalogProduct has_conditions: false - allow: true actions: - read - admin subjects: - Spree::CatalogAssignment has_conditions: false - allow: true actions: - read - admin subjects: - Spree::CustomField has_conditions: false - allow: true actions: - read - admin subjects: - Spree::DigitalAsset has_conditions: false - allow: true actions: - read - admin subjects: - Spree::Import has_conditions: false - allow: true actions: - read - admin subjects: - Spree::ImportRow has_conditions: false - allow: true actions: - manage subjects: - Spree::Product has_conditions: false - allow: true actions: - manage subjects: - Spree::Variant has_conditions: false - allow: true actions: - manage subjects: - Spree::OptionType has_conditions: false - allow: true actions: - manage subjects: - Spree::OptionValue has_conditions: false - allow: true actions: - manage subjects: - Spree::Price has_conditions: false - allow: true actions: - manage subjects: - Spree::PriceList has_conditions: false - allow: true actions: - manage subjects: - Spree::PriceRule has_conditions: false - allow: true actions: - manage subjects: - Spree::Catalog has_conditions: false - allow: true actions: - manage subjects: - Spree::CatalogProduct has_conditions: false - allow: true actions: - manage subjects: - Spree::CatalogAssignment has_conditions: false - allow: true actions: - manage subjects: - Spree::CustomField has_conditions: false - allow: true actions: - manage subjects: - Spree::DigitalAsset has_conditions: false - allow: true actions: - manage subjects: - Spree::Import has_conditions: false - allow: true actions: - manage subjects: - Spree::ImportRow has_conditions: false permission_keys: - read_products - write_products schema: $ref: '#/components/schemas/SellerMeResponse' '401': description: missing or invalid token content: application/json: example: error: code: authentication_required message: Authentication required schema: $ref: '#/components/schemas/ErrorResponse' security: - bearer_auth: [] components: schemas: SellerMeResponse: type: object description: >- The signed-in user, the sellers they may act for, and what they may do on the selected one properties: user: $ref: '#/components/schemas/TeamMember' sellers: type: array items: $ref: '#/components/schemas/SellerMeSummary' permissions: type: array items: $ref: '#/components/schemas/PermissionRule' permission_keys: type: array items: type: string description: >- Permission keys on the selected seller. Empty until `X-Spree-Seller-Id` names one — capability is per seller. example: - read_products - write_products required: - user - sellers - permissions - permission_keys ErrorResponse: type: object properties: error: type: object properties: code: type: string example: record_not_found message: type: string example: Record not found details: type: object description: Field-specific validation errors nullable: true example: name: - is too short - is required email: - is invalid required: - code - message required: - error example: error: code: validation_error message: Validation failed details: name: - is too short email: - is invalid TeamMember: type: object properties: id: type: string email: type: string first_name: type: string nullable: true last_name: type: string nullable: true full_name: type: string nullable: true created_at: type: string avatar_url: type: string nullable: true required: - id - email - first_name - last_name - full_name - created_at - avatar_url x-typelizer: true SellerMeSummary: type: object description: >- A seller the signed-in user may act for, as `/me` reports it — the login response carries the same fields without `slug`. properties: id: type: string description: Prefixed seller ID — send as `X-Spree-Seller-Id` example: sel_abc123 name: type: string example: Acme Supplies slug: type: string example: acme-supplies status: type: string example: approved description: Seller lifecycle status required: - id - name - slug - status PermissionRule: type: object description: >- A single permission rule (CanCanCan rule). Rules are applied in order, last-matching-wins. properties: allow: type: boolean description: true for `can`, false for `cannot` actions: type: array items: type: string description: Action names, e.g. ["read", "update"] or ["manage"] subjects: type: array items: type: string description: Subject class names, e.g. ["Spree::Product"] or ["all"] has_conditions: type: boolean description: >- True if the server-side rule has per-record conditions. The SPA shows the action optimistically and handles 403 from the API. required: - allow - actions - subjects - has_conditions securitySchemes: bearer_auth: type: http scheme: bearer bearerFormat: JWT description: JWT token for an authenticated seller session (`seller_api` audience) ````