Skip to main content

​
Public Marketplace and Invite Flows

These routes are outside workspace-owner /api/affiliate/* management APIs.

​
Marketplace endpoints

  • GET /api/affiliate/marketplace/eligibility
  • GET /api/affiliate/marketplace/programs
  • GET /api/affiliate/marketplace/programs/:slug
  • GET /api/affiliate/marketplace/programs/:slug/application-form
  • POST /api/affiliate/marketplace/programs/:slug/apply
  • GET /api/affiliate/marketplace/programs/:slug/similar
  • DELETE /api/affiliate/marketplace/programs/:slug/application

​
Auth model for marketplace routes

Marketplace discovery/mutation uses partner-session auth (cookie-backed partner context), not workspace member auth. If partner session is missing/invalid, routes return 401.

​
Eligibility rules

GET /api/affiliate/marketplace/eligibility checks three requirements:
  • approved in at least one program
  • earned minimum commission threshold
  • no ban status

​
Browse programs

GET /api/affiliate/marketplace/programs Query params:
  • page
  • limit
  • query (search by name)
Only active marketplace-listed programs are returned.

​
Apply payload

POST /api/affiliate/marketplace/programs/:slug/apply 
{
  "partnerId": "part_123",
  "formData": {
    "website": "https://creator.example",
    "audience": "EU SaaS founders"
  }
}
Behavior:
  • Session partner must match partnerId.
  • Rate limited to 5 apply attempts/hour per partner.
  • Rejects duplicate enrollments.
  • Supports dynamic custom application forms.
  • Enrollment may be approved or pending depending on auto-approve and fraud checks.

​
Withdraw application

DELETE /api/affiliate/marketplace/programs/:slug/application Only pending applications can be withdrawn.

​
Public invite accept

  • POST /api/invites/:token/accept
Behavior:
  • Public route with IP rate limit (5/hour).
  • Validates token format and expiry.
  • Auto-creates partner if needed.
  • Creates approved enrollment with referral code.

​
Public discount validation

  • GET /api/discounts/validate?code=...&programId=...&amount=...
Behavior:
  • Public route with IP rate limit (10/min).
  • Validates code status, expiry, and max uses.
  • Returns calculated discount amount and attribution partner ID if valid.

​
Common errors

  • 400: malformed payload, invalid status transition, token format errors
  • 401: missing partner auth for marketplace routes
  • 403: not eligible or partner/session mismatch
  • 404: program/token/code not found
  • 409: duplicate enrollment/application conflict
  • 429: rate limited