Contact Endpoints

Operations

Scoping And Permissions

Reads default to the authenticated user's account (CustomerCode claim). Create, update, and read accept optional customerCode so master contacts and account administrators can target another allowed account.

• Read (GetAll, GetById): defaults to the caller's account. Supply customerCode to read another account (master contact, or an account Administrator whose allowed set includes that code). A contact flagged to limit search to their own orders only sees their own record on their own account, unless they are an account Administrator.
• Create: account Administrator on their own account, or on bill-to accounts in AdditionalWebAccess when optional request customerCode is supplied. Master contacts may create under any account via customerCode. New contacts default to webAccess = Administrator and receive Payments API permission for their account.
• Delete: account Administrator only (caller's account).
• Update: an Administrator can update any contact on the account; other users can update only their own record. Master contacts can update under any account by supplying customerCode. Web access level and the search-limit flag are administrator-only.
• Delete is a soft delete: the contact is marked retired rather than removed.