Operation
Match a customer
POST
/customers/matchFind a customer by exact email or exact phone, for attaching a returning buyer to a cart or an order. Answers candidates redacted to an id, first name, last initial, masked email and the last four digits of the phone, so a detail that is wrong can be seen and corrected; staff also get match, the first candidate with its account and blocked flag. Exact only: a partial address is refused, there is no wildcard, no search and no list. One lookup per call, at most 5 candidates, rate-limited per actor (60 a minute; a channel secret key also 300 an hour) and logged. In a shared organisation the match is organisation-wide; in an isolated one it stays inside the accounts the caller holds. A channel secret key that matches by email may then correct that customer's name and phone (POST /customers/{customerId}/correct).
Body
emailstring (email)Exact email address to match, case-insensitive
phonestringExact phone number to match, as stored
Returns
The lookup ran; match is the customer found or null
Errors
- 400
- Bad Request - Invalid input
- 401
- Unauthorized - Authentication required
- 403
- Forbidden - Insufficient permissions
- 404
- Not Found - Resource not found
- 500
- Internal Server Error
Every error names its code and links to it. All error codes
curl -X POST "https://api.ticketlayer.com/v1/customers/match" \ -H "Authorization: Bearer tlak_..." \ -H "X-Ticketlayer-Org: your-org-slug" \ -H "Content-Type: application/json" \ -d '{ "email": "customer@example.com", "phone": "+44 7700 900000" }'Response 200
{
"match": {
"id": "cus_abc123",
"accountId": "acc_xyz789",
"firstName": "John",
"lastInitial": "D",
"maskedEmail": "c***@e***.com",
"maskedPhone": "***0000",
"isBlocked": false
},
"candidates": [
{
"id": "cus_abc123",
"firstName": "John",
"lastInitial": "D",
"maskedEmail": "c***@e***.com",
"phoneLast4": "0000"
}
]
}