Look after customers in the staff console

The Customers page of the staff console, /staff/customers, lists every account on your storefront. Each customer's page, the Customer 360, gathers their servers, invoices, tickets, notes and history in one place, with the facts your team looks at while it acts in a column beside it. From there your team corrects an account, adds credit, helps the customer sign in, and opens a support session to see your storefront as the customer sees it.

Any member can open the list and a customer's page. What else each task needs:

A step-up is a fresh password or authenticator code, which lasts 10 minutes; Sign in to the staff console explains it.

A control your role cannot use stays on the page, dimmed. Point at it, or move focus to it, and it names the role it needs, such as Needs Tier 3 support or higher. What a role cannot use explains it, and the console's saved views, quick view and keyboard shortcuts work on this list as on every other.

1. Open /staff/customers.
2. Search by email, first or last name, username, company or customer ID, the exact address an account signed up from, or a linked Discord account's name or ID. A * matches anything, so j*@example.com finds every address at that domain that starts with j. A word with an @ is matched against addresses only, so it never finds a name or company. Press / to move to the search box.
3. Pick a customer group from the strip under the tiles, a status, a label or a Discord choice (below).
4. For a wave of sign-ups, choose Filters to narrow by email domain (subdomains count) and by the days they signed up. A link from a pattern on the Abuse page keeps that pattern's accounts, and the chip above the list names the pattern (Stop a wave of abusive sign-ups).

When you search for a hostname or an invoice number, the page also lists the matching services and the matching invoices under the table of people. Below Tier 3 support the invoices are text and do not open.

Paying customers come first: those with at least one service that is not on your free tier. Inside each of the two groups the newest sign-ups come first, and the customer ID settles a tie, so a page never repeats or skips a customer. A service is on your free tier when its product is a free tier or when the server that belongs to it sleeps when nobody plays. The server linked to the service decides on its own, and a service that costs nothing because of a promotion is not on the free tier. The counts on the tiles and the groups always cover the whole directory under the audience switch, so a search or a filter narrows only the list.

The list shows its rows first, and the tiles and group counts above it fill in a moment later. The rows are always current, but a figure that counts the whole directory can be a little old. While you work, Paying, Free and the count beside each customer group are normally no more than a minute behind a new order or payment, and under the Paying or Free audience so is every other tile. On the first screen after the console has been quiet for a while they can be up to 10 minutes old, and they catch up within a few seconds. The choice of who is a VIP is worked out again every 10 minutes, and after a quiet spell it can be up to 30 minutes old. When you choose Paying or Free, or the audience switch is Paying or Free, and you use no search or other filter, the number of customers the list reports follows the same limits. With a search or any other filter the number is counted when you ask.

The list, its counts, search, the CSV export and the dashboard's customer figures leave out placeholders: authors of forum threads moved from your old site who have not moved their own accounts yet (status unclaimed). A placeholder's page still opens from a link, with a note that says what it is. Nobody can change its standing or email, set its password, add credit, invoice it or close it; it becomes that person's account when they move theirs. Link your old site to your storefront explains the move.

The strip under the tiles holds one button for each group, with its count: All, VIP, At risk, One-time, Past due, No server and New. A group is a filter you can combine with the search, the status, the label and the Discord choice. Point at a group, or open the question mark beside the strip, to read what it means.

A paid invoice has the status paid, a payment date and a total above zero. Lifetime payments are the sum of the customer's payments, one sum for each currency. A placeholder is in no group. The number beside a group is the number of customers the list shows when you pick it, normally within a minute of an order, an invoice or a payment that changes who is in the group.

• The six tiles are All customers, Paying, Free, Unverified, New this week and Suspended. Each is a filter, and each counts the whole directory. Paying and Free are normally up to a minute behind (under the Paying or Free audience, every tile is). Paying means at least one paid server, Free means the free tier or no server yet, Unverified means the email was never confirmed, and New this week means joined within 7 days. The Unverified and Suspended tiles turn muted when their count is zero.
• The Status choice lists Any status, Active, Suspended, Closed and Banned, each with its count. The Label choice lists the labels your team uses, and a change to an account's labels shows there within a few seconds. A label that changes any other way, such as when an account is removed, can take up to 5 minutes to show, and up to 30 minutes on the first screen after a quiet spell. The Discord choice is Any Discord, Discord linked or No Discord.
• Every filter shows as a chip above the list, and Clear removes them all. All of it is in the address, so you can send a view to a colleague, and Back finds it again.
• Views is a menu beside the groups. Built in lists All customers and each group. My views lists the views you saved, and Shared with the team lists the ones a teammate shared. Choose Save this view to keep the current filters under a name of up to 80 characters. Tier 3 support and up can tick Share with the team, so everyone can open it, and anyone can tick Pin as a tab to show it as a button beside Views. Only the person who saved a view changes it. Manage views renames, pins, shares or deletes your own.
• Columns, above the table, adds columns the list leaves out: Labels, Discord, Last sign-in, Credit, Tickets and Country. The choice stays in your browser.
• Select a row to open its quick view, a card of the customer's figures, servers, invoices and tickets in a drawer, with an Open customer button. Press j and k to move between rows, Enter for the quick view, o to open the page and x to tick a row. Hold Ctrl or Cmd and click to open the page in a new tab.
• A row's menu holds Open customer, Open a ticket, Sign in as, and Copy email. The header says when the list last arrived, and its refresh button reloads it.

The page opens on the customer's name, with badges for their standing and a linked Discord account. Under the name come their customer ID, when they joined, their last sign-in, their email, company, labels, and the role they hold if they are on your team. Open a ticket and Sign in as sit beside a menu of the other actions, and the back link returns to the list.

When something needs a person now, one callout says so, with the action that deals with it: an account that is not active and why, an email never verified, unpaid invoices and what is owed, suspended servers, servers that did not come up, and tickets waiting for your reply.

Six figures sit under it, and each leads to the tab that explains it:

The tabs run in this order:

On a page 1280 pixels wide or more, a column of facts stays beside the tabs. Narrower, it moves under them. Its panels are:

• Profile: email, name, company, phone, country, currency, auto-pay, how they sign in, the address they signed up from and their first order. Edit changes it.
• Labels and notes: your team's labels as chips, a box to add one, and the five newest notes with Add note. The Notes tab shows the labels alone, since every note is beside it.
• Related accounts, for Tier 3 support and up: how many other customers share a signal with this one, and which: Sign-up IP, Device, Phone or Session IP. A match is a reason to look, never a verdict. The Sign-up IP chip searches the list for that address. A callout says how many of them are suspended or banned. When the customer belongs to an open or blocked abuse pattern, a chip names it, and choosing it lists the pattern's accounts. Below Tier 3 support the chips show in a panel of their own, as text.
• Discord standing: the linked account, its age, since when it is linked, and whether it meets the free-server age rule, or the day it will.
• Attribution: where the customer came from, described below.

The Discord standing panel names the linked Discord account: its username and ID, how old it is, since when it is linked, and whether it meets the free-server age rule. A free order from a VPN, proxy or hosting network needs a Discord account at least 30 days old (How free servers work). For Tier 3 support and up, the Link history panel on the Account tab lists every link, move, unlink and refused attempt on the account, newest first, with the address it came from. It also lists those of its Discord account on your other customers' accounts, each naming that account, so you can find every account that tried one Discord account.

The Attribution panel, last in the column beside the tabs, says how the account was made and where its owner came from. Every member who opens the page reads it. It is the record in What a customer records, drawn as facts:

A channel is one of Paid search, Paid social, Display, Organic search, Organic social, Email, Affiliate, Referral, Direct or Other (Channels). The pill is blue for paid channels, green for the others that bring visitors and grey for Direct and Other.

An account your team created, and one made before we recorded attribution, has none. The panel then says "No source recorded". The panel never shows an address.

Each tab loads its own data when you open it:

• Activity lists what your team did to the account and its services, sign-ins and support sessions, invoices raised and paid, credit and refunds, and tickets opened and closed, newest first.
• Emails lists what your brand sent the customer, newest first. Each row shows the subject, the kind of email and the address it went to, then the columns Delivery, Opened, Clicked and When. A failed email shows its error under the subject.
• Payment methods, in the Billing tab, are shown as the customer sees them: a label, the card brand, the last four digits and the expiry.
• The Account tab lists sessions, and other accounts that share the sign-up IP address, the sign-up browser, the phone number or a recent session address. A shared address is a signal to weigh, since a household shares one too.

The Opened and Clicked columns count real people. We leave out security scanners and mail privacy proxies, which open and click every message. In each column:

• A green pill reads "Opened" or "Clicked". When the customer did it more than once, the pill adds the count, for example "Opened, 3".
• Grey text reads "Not opened" or "No clicks" for an email we tracked that nobody opened or clicked.
• A grey "—", with the tooltip "Not tracked", means we did not track the email. Security emails such as sign-in codes and password resets are never tracked. Neither are emails sent before tracking began, or any email while your organization has tracking turned off.

When Maileroo also reported opens or clicks for the email, a line under the subject reads, for example, "Maileroo: 4 opens, 1 click". The Maileroo count is its own and often differs from ours, because Maileroo may count scanners. We show the two side by side and never add them.

An account that moved from your old site opens with where it came from: the old username and ID, when it moved and how (a new account, a claimed placeholder, or merged into an account here), what was credited and how it was worked out, the saved cards that moved, the social sign-ins it used on the old site, the sign-in links it could not bring over and why, and whether the old site confirmed the move. When another account on your storefront holds a link that stayed behind, the page names that customer and links to them. It says whether that customer looked empty when the move ran (no payments, no credit, no servers and not a moved account), which usually means that signing in with the provider made a second account for the same person. A record made before the move named the holder says only that another account holds the link. A move that staff ran for the customer reads "Moved by staff in run #N", and an account that used two-factor in the old panel says so, because that did not move and the customer should turn it on here. Below come up to 20 alerts from the old site, newest first: a payment or deposit that reached the old account after it moved, a chargeback on an old charge, a balance that changed after the old site locked it, or an old site that had already finished the move. Nothing is credited or deducted for an alert, so settle each one by hand, for example with credit.

After a move, we tell your old site that it finished, and the old site then sets the old balance to zero. When the old site did not answer, the customer's page says it has not confirmed the move. A member with the billing role or higher can ask it again from there.

The page then shows when the old site confirmed. If a balance changed on the old site after it locked the account, the difference shows on the page with an alert, for you to settle by hand. Link your old site to your storefront explains the move.

• Correct the email, name, company or phone with Edit in the Profile panel. A new email address is unverified until the customer confirms it: we send a verification link to the new address, and tell the old one about the change. An admin can also change the billing currency.
• Resend the verification email from the callout or the Account tab, or, as an admin, choose Mark email verified in the Account panel's menu when the customer proved it another way. Marking an address verified counts as the customer's first proof of it: the pending confirmation link goes, an authenticator on an account with no password goes, and invites to share a server with the address apply. On an account that moved from your old site with an address the old site never confirmed, it also removes the sign-in links that the move carried over, because the person who proves the address may not own those provider accounts. The customer signs in with their email address and connects each provider again. Marking does not end the customer's sessions, which their own proof by email does. The removal is recorded in the audit log as customer.oauth_links_cleared, with the provider names.
• Label the account for your team. Type a label in the box under the chips and press Enter, or select the X on a chip to remove it. Each change saves at once. An account takes up to 12 labels of up to 30 letters, digits, spaces, - and _, and the list filters by them. Tier 3 support and up change labels.
• Add a note for your team with Add note, in the rail or on the Notes tab, up to 8,000 characters. Tier 1 support and up can add one.

1. On the customer's page, open the menu beside Sign in as and choose Adjust credit, or open the Billing tab and choose Adjust credit in the Wallet panel.
2. Choose Add credit, for goodwill, a comp or an outside payment, or Deduct credit, for a correction.
3. Enter the amount. A deduction cannot take the balance below zero, and the dialog says what would be left.
4. Add a reason if you like, up to 120 characters. It appears in the customer's wallet history, and, for credit you add, in the email we send them.
5. Choose the button, which names the amount, and confirm it is you if the console asks.

The customer gets an email when you add credit. Each member may change credit 30 times an hour.

• Reset their password from the Account tab or the menu: set a new one of at least 8 characters, with a lowercase letter, an uppercase letter, a digit and a special character. It ends every session the customer has, and we email them that your team changed it.
• As an admin, choose Reset two-factor in the Account tab when they lost their phone. It removes the second factor and ends their sessions; they sign in with the password and, if your brand requires it, set it up again.
• End one of their sessions, or all of them, in the Sessions panel of the Account tab. Each session shows its kind: a sign-in, an app they authorised, a support session or a team member's own account.

Sign in as opens a support session: your storefront in a new tab, signed in as the customer, with a banner that says who is inside. The dialog offers three kinds of session:

A kind your role cannot open is dimmed and names the role it needs. Full access asks for the reason in the same dialog, and it goes on the record. You may be asked for your password or a code first.

A session lasts 30 minutes and cannot be extended. The console says how long it has when it opens, as in ends in 30 minutes. It opens only on an active account, and only when your organization has a custom domain or a storefront address to open it on. Each member may open 20 an hour, together with those opened from the dashboard.

Opening a session is recorded in the customer's activity with your name and the kind of session. Everything a session that can make changes does is recorded against you in the audit log, and the customer's own session list shows the support session. On the storefronts Coritan serves, End session in the banner takes the tab back to the customer's page here. The dashboard opens the same sessions from Sign in as customer… (Sign in as a customer).

Tier 3 support can start a ticket with a customer from Open a ticket on their page, or from a row's menu. The New ticket dialog opens with the customer chosen. Fill in:

• Subject, up to 255 characters, and Message to the customer, up to 20,000. They get it by email and see it in their support area.
• Priority and Department, and About an order when the customer has services and the ticket concerns one.
• Assign it to me, ticked by default. Untick it to leave the ticket in the department's queue.

Answer customer conversations covers the ticket from there.

Closing an account that moved from your old site removes the old username from its move record. The old ID and the credit stay, as the record of the money that moved.

• As an admin, change the account's status to suspended or banned, with a reason, or back to active, with Suspend or ban in the Account tab or the menu. Leaving active ends every session the customer has, cancels invitations they hold to share other customers' servers, and disconnects their open server consoles.
• As an admin, close the account for good with Close account in the Account tab's danger zone. Closing anonymises it and cannot be undone. It needs a reason of 3–500 characters, and it is refused while the customer has active services or unpaid invoices.
• To act on many accounts at once, tick up to 100 in the list and choose an action in the bar. Suspending their orders, or lifting that suspension, is Tier 3 work. Terminating their orders, pausing or banning the accounts, or suspending with a deletion date 1–90 days out needs an admin and a step-up. Below admin the bar leaves those buttons out and says Pausing, banning and terminating need an admin. Pausing suspends the account and every order on it; unsuspending the account brings it back. A ban also terminates everything the account runs.
• To act on every account a filter matches, tick the whole page and select all matching customers. The action then starts a bulk run in the background, up to 20,000 accounts, which opens no tickets unless you ask it to (Stop a wave of abusive sign-ups). A customer group, such as Past due, can drive a run like any other filter, and the run's count equals the list's.

A bulk action skips a placeholder and lists it with the accounts it skipped. Every bulk action but lifting a suspension opens one high-priority ticket per customer with a notice for them, keeps your reason as an internal note, and assigns the ticket to you. Turn that off if you will contact them another way.

• A billing member can choose Export CSV in the page header to download the list as CSV, filtered as it is on screen, up to 20,000 customers. The file is in the order of the list: paying customers first, then the newest sign-ups. When more than 20,000 customers match, it holds the first 20,000 in that order, so narrow the list with a filter to export the rest.
• For a privacy request, an admin can choose Export data in the menu, or Download data in the Account tab's Privacy request panel, to download everything held about one customer as a JSON file. It includes your team's notes and the internal notes on their tickets, so review it before you send it. Passwords, session tokens, two-factor secrets, payment tokens and the files on their servers are not in it.

Exports count towards a limit of 12 an hour for each member.

Tier 3 support can choose New customer to create an account for someone who ordered by phone or email: enter the email and, if you like, a name, company, phone and currency. We email the customer a link to choose a password, so nobody on your team knows it. The link works for 48 hours, and a forgot-password request from the customer does not cancel it. The account counts towards your organization's customer limit.

The customer's account shows your change at once, and every change is in the audit log with who made it.

Customer limit reached (100/100)

Your organization holds as many customers as Coritan allows. Contact support to raise the limit.

A customer with that email already exists

Search for the address: the customer already has an account.

409 A placeholder for a moved forum author cannot ...

The page is a placeholder for the author of forum threads moved from your old site. It becomes an account when its owner moves theirs; until then nobody can change it.

Another customer already uses that email

The new email belongs to another account on your storefront. Emails are unique within an organization.

Changing a customer's status or currency needs an org admin

Ask an owner or admin to make the change.

Ending orders or accounts, or pausing them, needs an org admin; support can suspend without a deletion date

Support can suspend orders in bulk only without a deletion date. Ask an admin to terminate, pause, ban or schedule a deletion.

Close the account through the close route; it also anonymises it

You tried to set the status to closed. Use the close action instead.

A closed account cannot be reopened

A closed account is anonymised. The customer can register again.

Closing is refused with active_services or unpaid_invoices

Cancel the customer's services, or settle or cancel their unpaid invoices, then close the account.

This customer is suspended and cannot be impersonated.

Support sessions open only on active accounts. Reactivate the account first, or read it from the customer's page.

Say why a full-access session is needed (at least a few words); it goes on the record.

A full-access session needs a reason of at least 5 characters.

Only an org admin can open a session that changes a customer's servers.

Servers and Full access sessions need an admin. Open a Look only session, or ask an admin.

This organization has no storefront address yet, so there is nowhere to sign in as its customer.

A support session opens on your custom domain, or on your store's storefront address, and you have neither. Set a custom domain, or a Storefront address in your store's settings, then open the session again.

The wallet holds 5.0000; it cannot go below zero.

You tried to take away more credit than the customer has.

A verification mail went out recently; try again in 45 seconds

We sent a verification email a short time ago. Wait the number of seconds it gives.

Customer not found

No customer with that ID belongs to your organization.

segment must be one of: vip, at_risk, one_time, past_due, no_server, new

A link or a request named a group the list does not have. Use one of the words the message lists.

• Manage customers from the dashboard's Customers tab
• Handle billing in the staff console
• Answer customer conversations
• Sign customers in to your storefront

These routes live under https://api.coritan.com/api/v1/orgs/{org_slug}/staff/customers, and take a console session or a member's access token as The staff console explains. The reference lists them all under Customers in the staff console.

curl "https://api.coritan.com/api/v1/orgs/acme/staff/customers?q=alex&status_filter=active&segment=past_due&audience=paid&limit=50" \
  -H "Authorization: Bearer $STAFF_TOKEN"

q takes up to 200 characters, tag one label, limit 1–200 (50 by default) and offset. status_filter is an account status, or unverified, new_7d, paying or free. segment is a customer group: vip, at_risk, one_time, past_due, no_server or new. Any other word answers 422 and names the words. q also matches a sign-up address exactly, and a linked Discord account's name or ID. A q with an @ is matched against email addresses only. The list is paying customers first, then the newest sign-ups, with the customer ID as the last tiebreak, so a page never repeats or skips a customer. The filters for a wave of sign-ups are:

• email_domain: accounts on the domain or one of its subdomains.
• created_after and created_before: a date or a date and time.
• discord: linked or unlinked.
• pattern_id: the accounts of a pattern (Stop a wave of abusive sign-ups). For an email-domain pattern that is the accounts on the domain and its subdomains that signed up no more than 30 days before the pattern was first seen.

The answer has total, the customers on this page, and counts for the whole directory: all, one per status and one per bucket. None of them includes a placeholder, and status_filter=unclaimed matches nothing. The paying accounts are counted for the whole brand, not for each request, so paying and free normally trail a new order by up to a minute, and by up to 10 minutes on the first request after a quiet spell. Under the paid or free audience every count follows that. total trails the same way when the request has no filter but audience and a status_filter, and the audience is paid or free or the word is paying or free. Every other total and the customers on the page are counted when you ask. Each customer carries its services_total, services_active, unpaid_invoices, open_tickets, tags, is_free and discord, which says whether a Discord account is linked (linked) and how old it is in days (age_days).

GET /staff/customers/stats takes audience and answers all, the segments with one count for each group word, and definitions, a list of key, label and description. Each count comes from the clause the list filters with, so it equals the total of GET /staff/customers?segment=<word> under the same audience. The counts are normally no more than a minute old, and up to 10 minutes old on the first request after a quiet spell. The vip count and the segment=vip list use spending cutoffs that are worked out every 10 minutes, and that can be up to 30 minutes old after a quiet spell.

GET /staff/customers/export.csv takes the same filters, in the order of the list: paying customers first, then the newest sign-ups, up to 20,000 rows. GET /staff/customers/tags lists every label in use with its count. A change made with PUT /{customer_id}/tags shows in it within a few seconds. A label that changes any other way can take up to 5 minutes to show, and up to 30 minutes on the first request after a quiet spell.

curl https://api.coritan.com/api/v1/orgs/acme/staff/customers/812 \
  -H "Authorization: Bearer $STAFF_TOKEN"

The answer has customer, with the account and its lifetime_paid, lifetime_paid_by_currency, lifetime_refunded, first_order_at, open_disputes, abuse_patterns and staff_member, and up to 50 services, 50 invoices, 20 tickets and 50 notes. lifetime_paid_by_currency maps each currency code to what the customer paid in it, such as {"USD": "125.00"}, and is never summed across currencies. abuse_patterns lists the open or blocked patterns the account belongs to, newest activity first and at most 20, each with id, kind, value and status. attribution is how the account was made and where its owner came from, or null for an account your team made or one from before we recorded it: method, the first and last touch with their channel, ad network and utm_ fields, the click_ids with their ad network, device_type, country_code, the consent the visitor had and heard_about, the answer on the customer's first order that has one (What a customer records). discord says whether a Discord account is linked, with its username, discord_id, account_created_at, age_days, linked_at, and meets_age_rule: whether it is old enough for a free order from a VPN, proxy or hosting network, or qualifies_on, the day it will. legacy_move is null, or for an account that moved from your old site: old_user_id, old_username, account, moved_at, merged, credited_usd with its breakdown, cards, cards_error, providers, connections (the providers whose link came across), connections_skipped, acknowledged, acknowledged_at, drift, and up to 20 alerts, each with kind (late_money, chargeback, drift or not_pending), source, amount_cents, currency, reference, note and created_at. Each item of connections_skipped has a provider and a reason: linked_elsewhere (another account here already uses that provider account), provider_already_connected or account_not_active. A linked_elsewhere item also has held_by_customer_id, the customer who holds the link, and held_by_empty_account, which is true when that customer had no transactions, no credit and no services and was not a moved account when the move ran. Both keys are left out when nobody held the link, and on a record made before the move named the holder. The rest of the account has its own routes:

curl -X PATCH https://api.coritan.com/api/v1/orgs/acme/staff/customers/812 \
  -H "Authorization: Bearer $STAFF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "phone": "+44 20 7946 0000"}'

Send any of email, first_name, last_name, company and phone. An admin may also send currency, or status with a reason of up to 500 characters. The answer has the customer, what changed, whether a verification_sent, whether the old_address_notified, and how many sessions_ended. A new email makes the address unverified, sends the verification email to the new address and sends a notice to the address the account had, which says our support team changed it, so an owner who did not ask for it hears of it. The change is on the audit log with both addresses. A request that changes nothing answers 400 Nothing to change.

The other account actions are POST routes on the customer:

For a placeholder, a new status or email in PATCH, /resend-verification, /mark-verified, /reset-password, credit and a new invoice answer 409.

PUT /{customer_id}/tags with {"tags": ["reseller", "vip"]} replaces the labels. GET /{customer_id}/data-export downloads the privacy export, which holds the move record of an account that moved from your old site.

curl -X POST https://api.coritan.com/api/v1/orgs/acme/staff/customers/812/credit \
  -H "Authorization: Bearer $STAFF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"amount": "10.00", "description": "Goodwill credit for the outage"}'

amount is in the customer's currency and must not be zero; a negative amount takes credit away. description takes up to 500 characters and defaults to Manual credit. The console sends Staff credit or Staff deduction when you leave its reason empty. The answer is the new credit_balance.

curl -X POST https://api.coritan.com/api/v1/orgs/acme/staff/customers/812/impersonate \
  -H "Authorization: Bearer $STAFF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "read_only", "next": "/billing"}'

mode is read_only (the default, Look only in the console), servers or full; the older "elevated": true still means servers. servers and full need an admin and a step-up, and full a reason of at least 5 characters, up to 300. next is a path on your storefront to open once signed in. origin is where you opened the session: staff (the default) or dashboard.

The answer has a customer access_token that lasts 1800 seconds, with expires_in, expires_at, the mode, read_only, elevated (true for servers and full), org_slug, customer_email and a portal_url. That address is /auth/callback on your custom domain, or on your store's storefront address when you have no custom domain:

https://example.com/auth/callback#access_token=...&impersonated=1&from=staff&customer=812&next=/billing

Everything after # stays in the browser:

access_token

The customer's token for the session.

impersonated

Always 1: the address opens a support session.

elevated and mode

elevated=1 with mode=servers or mode=full for a session that can make changes. A read-only session has neither.

from

Where the session was opened: staff, dashboard, or admin for one Coritan support opened from its admin console.

customer

The customer's ID, only when from is staff, so ending the session can reopen their page in the staff console.

next

The path you asked for, when you sent one.

When your organization has neither a custom domain nor a storefront address, Coritan opens no session and answers 409:

{"detail": {"error": "no_storefront", "message": "This organization has no storefront address yet, so there is nowhere to sign in as its customer. Give it a custom domain, or a storefront address on its store, first."}}

The session's token may always sign itself out, in every mode: POST /api/v1/orgs/{org_slug}/auth/logout with the token as the bearer ends the session, answers {"message": "Logged out"}, and the token stops working within 10 seconds. That is how End session ends it.

A storefront you build receives the session on the same /auth/callback page as social sign-in. Receive a support session says how to check the token, show the person that they are acting as the customer and end the session.

curl -X POST https://api.coritan.com/api/v1/orgs/acme/staff/customers/bulk \
  -H "Authorization: Bearer $STAFF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"customer_ids": [812, 813], "action": "suspend", "reason": "Chargebacks on every order"}'

action is suspend, unsuspend, terminate, pause or ban, and reason takes 3–500 characters. pause suspends the account and every order it has, which ends its sessions; unsuspend brings a paused account back. pause, like terminate and ban, needs an admin after the step-up check. delete_after_days (1–90) schedules a deletion with a suspension, open_ticket defaults to true, and notify_customer sends the cancellation email with terminate. The answer lists the applied customers, the skipped ones with a reason, and each customer's orders, changed and ticket_id. Each member may run 12 bulk actions an hour, shared with bulk actions on servers. To act on every account a filter matches rather than a list of ids, start a bulk run (Stop a wave of abusive sign-ups). The filter of a customers run may carry segment, a group word of the list, and the run's total equals the list's.

curl -X POST https://api.coritan.com/api/v1/orgs/acme/staff/customers \
  -H "Authorization: Bearer $STAFF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"email": "alex@example.com", "first_name": "Alex", "currency": "EUR"}'

It answers 201 with the customer and setup_email_sent. Send "send_setup_email": false to hand the account over another way. A currency the platform has not enabled answers 400 and names it.