Admin vendor applications
Optional status filter (pending|approved|rejected). Newest first.
Authorization
better-auth.session_token In: cookie
Query Parameters
Value in
- "pending"
- "approved"
- "rejected"
Response Body
application/json
curl -X GET "https://example.com/api/v1/admin/vendor-applications"[ { "id": "string", "email": "string", "full_name": "string", "phone": "string", "store_name": "string", "description": "string", "location_address": "string", "location_lat": "string", "location_lng": "string", "ssm_cert_url": "string", "logo_url": "string", "banner_url": "string", "bank_name": "string", "bank_account_number": "string", "bank_account_name": "string", "status": "string", "rejection_note": "string", "reviewed_at": "string", "created_at": "string", "updated_at": "string", "tin": "string", "msic_code": "string", "sst_reg_no": "string", "intermediary_consent_accepted": true, "intermediary_consent_at": "string", "intermediary_consent_tos_version": "string" }]Authorization
better-auth.session_token In: cookie
Path Parameters
Response Body
application/json
curl -X GET "https://example.com/api/v1/admin/vendor-applications/string"{ "id": "string", "email": "string", "full_name": "string", "phone": "string", "store_name": "string", "description": "string", "location_address": "string", "location_lat": "string", "location_lng": "string", "ssm_cert_url": "string", "logo_url": "string", "banner_url": "string", "bank_name": "string", "bank_account_number": "string", "bank_account_name": "string", "status": "string", "rejection_note": "string", "reviewed_at": "string", "created_at": "string", "updated_at": "string", "tin": "string", "msic_code": "string", "sst_reg_no": "string", "intermediary_consent_accepted": true, "intermediary_consent_at": "string", "intermediary_consent_tos_version": "string"}Flips status=rejected, stores the note, stamps reviewed_at. Sends a rejection email (non-blocking — send failures log-warn and do not fail the request). Approve + resend-credentials flows still use the legacy server action until V7.9b lands the account-creation port.
Authorization
better-auth.session_token In: cookie
Path Parameters
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
curl -X POST "https://example.com/api/v1/admin/vendor-applications/string/reject" \ -H "Content-Type: application/json" \ -d '{ "note": "string" }'{ "id": "string", "email": "string", "full_name": "string", "phone": "string", "store_name": "string", "description": "string", "location_address": "string", "location_lat": "string", "location_lng": "string", "ssm_cert_url": "string", "logo_url": "string", "banner_url": "string", "bank_name": "string", "bank_account_number": "string", "bank_account_name": "string", "status": "string", "rejection_note": "string", "reviewed_at": "string", "created_at": "string", "updated_at": "string", "tin": "string", "msic_code": "string", "sst_reg_no": "string", "intermediary_consent_accepted": true, "intermediary_consent_at": "string", "intermediary_consent_tos_version": "string"}Dual-writes the vendor account into Supabase Auth (auth.users) and BetterAuth (public.user + public.account) so middleware + API guards both recognize the user. Creates the stores row with Phase-17 TIN/MSIC/SST. Replays intermediary consent audit. Sends MUST-deliver credentials email via EmailService.send() — failure returns 500 so admin can retry/resend.
Authorization
better-auth.session_token In: cookie
Path Parameters
Response Body
application/json
curl -X POST "https://example.com/api/v1/admin/vendor-applications/string/approve"{ "id": "string", "email": "string", "full_name": "string", "phone": "string", "store_name": "string", "description": "string", "location_address": "string", "location_lat": "string", "location_lng": "string", "ssm_cert_url": "string", "logo_url": "string", "banner_url": "string", "bank_name": "string", "bank_account_number": "string", "bank_account_name": "string", "status": "string", "rejection_note": "string", "reviewed_at": "string", "created_at": "string", "updated_at": "string", "tin": "string", "msic_code": "string", "sst_reg_no": "string", "intermediary_consent_accepted": true, "intermediary_consent_at": "string", "intermediary_consent_tos_version": "string"}Only valid for approved applications. Generates a fresh 16-char password, dual-updates Supabase Auth + BetterAuth, sends credentials email via EmailService.send() — delivery failure returns 500 (password was already reset; admin can re-trigger this endpoint).
Authorization
better-auth.session_token In: cookie
Path Parameters
Response Body
curl -X POST "https://example.com/api/v1/admin/vendor-applications/string/resend-credentials"