List Return Messages
List the conversation thread of a return (RMA) request, newest first. The return must belong to the authenticated customer. Each message is flagged with isAdmin so a client can tell who sent it, and carries an optional attachment.
Endpoint
GET /api/shop/return-messagesAuthentication
This endpoint requires an authenticated customer — send the storefront key and a customer Bearer token. See the Authentication page.
Request Headers
| Header | Required | Description |
|---|---|---|
Content-Type | Yes | application/json |
X-STOREFRONT-KEY | Yes | Your storefront API key |
Authorization | Yes | Bearer token (customer login required) |
Query Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
return_id | integer | Yes | Id of the return whose messages to list. Must belong to the authenticated customer. |
Response Fields (200 OK)
The response is a plain JSON array. Each item is a message object.
| Field | Type | Description |
|---|---|---|
id | integer | Numeric message id. |
rmaId | integer | Id of the return the message belongs to. |
message | string | The message text. |
isAdmin | boolean | true if sent by the store, false if sent by the customer. |
attachment | string | Stored attachment path, or null. |
attachmentUrl | string | Public URL of the attachment, or null. |
createdAt | string | ISO 8601 message timestamp. |
Status Codes
| Status | Meaning |
|---|---|
200 OK | Messages retrieved. |
400 Bad Request | return_id is missing. |
401 Unauthorized | Missing or invalid customer Bearer token. |
403 Forbidden | Missing or invalid storefront key. |
404 Not Found | The return does not exist or is not the customer's. |