curl --request GET \
--url https://api.tassyir.io/apps/2026-10/offers/{id}/codes \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tassyir.io/apps/2026-10/offers/{id}/codes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": [
{
"id": "<string>",
"code": "<string>",
"usageLimit": 0,
"uses": 0,
"disabled": true,
"disabledAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z"
}
],
"nextCursor": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "INVALID_CURSOR",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "APP_TOKEN_INVALID",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 403,
"detail": "<string>",
"code": "OFFER_NOT_OWNED",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "NOT_FOUND",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 429,
"detail": "<string>",
"code": "BUSINESS_RATE_LIMITED",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 500,
"detail": "<string>",
"code": "INTERNAL_ERROR",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "API_BUSY",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}List an offer's codes
Newest first, disabled codes included. Only the owner reads them: An app changes, and reads the codes and redemptions of, only the offers its own installation created (ownerInstallationId is set from the token when it creates one). A merchant’s offer, or another app’s, is 403 OFFER_NOT_OWNED; an offer the token cannot see (another business, a store outside the installation’s stores) is 404.
Needs the read_offers scope (permission offers:read).
curl --request GET \
--url https://api.tassyir.io/apps/2026-10/offers/{id}/codes \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tassyir.io/apps/2026-10/offers/{id}/codes', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": [
{
"id": "<string>",
"code": "<string>",
"usageLimit": 0,
"uses": 0,
"disabled": true,
"disabledAt": "2023-11-07T05:31:56Z",
"createdAt": "2023-11-07T05:31:56Z"
}
],
"nextCursor": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 400,
"detail": "<string>",
"code": "INVALID_CURSOR",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 401,
"detail": "<string>",
"code": "APP_TOKEN_INVALID",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 403,
"detail": "<string>",
"code": "OFFER_NOT_OWNED",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 404,
"detail": "<string>",
"code": "NOT_FOUND",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 429,
"detail": "<string>",
"code": "BUSINESS_RATE_LIMITED",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 500,
"detail": "<string>",
"code": "INTERNAL_ERROR",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}{
"type": "<string>",
"title": "<string>",
"status": 503,
"detail": "<string>",
"code": "API_BUSY",
"docs": "<string>",
"fix": "<string>",
"requestId": "<string>",
"errors": [
"<string>"
]
}Authorizations
An app access token from POST /apps/oauth/token, valid 1 hour. An offline token acts as the app; an online token acts as the app on behalf of one dashboard user (the intersection of both permission sets).
Path Parameters
A resource id. One this installation cannot read, or a malformed one, is 404 NOT_FOUND.
1Query Parameters
Page size, 1 to 100 (default 50). A value outside that range is 400, never clamped.
1 <= x <= 100The nextCursor of the previous page, unchanged, with the same filters. Opaque; bound to this list and its filters (400 INVALID_CURSOR otherwise).
512Return only these top-level fields, separated by commas; the id is always kept. The response schema describes the whole resource. An unknown name is 400 INVALID_FIELDS. Fields: id, code, usageLimit, uses, disabled, disabledAt, createdAt.
1000