Retrieve marketing flow settings
The store’s flow sending policy. A store that has never saved one reads the DEFAULTS rather than a 404, because those defaults really are what the engine is running under; updated_at is NULL in that state, and that null is what the first PUT must send back as expected_updated_at. THE TWO HOURS ARE A SEND WINDOW, NOT A QUIET PERIOD. Sending is PERMITTED while the recipient’s local hour is in [send_window_start_hour, send_window_end_hour) and deferred otherwise, so the policy “quiet hours 21:00 to 09:00” is the window [9, 21), which is the default. Reading it backwards is the single likeliest way to mail a merchant’s whole list at 3am. updated_at is ALSO THE VERSION TOKEN. Send it back as expected_updated_at on the PUT, or null if this store has never saved, and your write refuses rather than reverting a change you never saw.
Authorizations
A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.
Response
Success