> ## Documentation Index > Fetch the complete documentation index at: https://docs.feddi.io/llms.txt > Use this file to discover all available pages before exploring further. # List a customer's promotional grants and their state-machine state > Lists a customer's promotional-money grants and the lifecycle state of each. Each grant in the response includes its `source` (`CASHBACK`, `RELOAD_BONUS`, `SKU_TOPUP_BONUS`, or `GATEWAY_BONUS`), its `state` (`LOCKED`, `RELEASED`, `CLAWED_BACK`, or `EXPIRED`), its original amount, its remaining amount (`remaining_minor`), and its expiry. All amounts are integer minor units in the grant's explicit ISO-4217 currency. **Promotional money is a separate value class from the customer's spendable cash balance**: it expires, is never cashable out, and is spent before cash under promo-first ordering. A `CASHBACK` grant accrues in `LOCKED` state and does not become available until the customer registers (proves phone ownership) and the merchant's claim gate is satisfied; only then does it transition to `RELEASED`. Use this endpoint as the operational view of what bonus value a customer holds and in what state. This endpoint is read-only and tenant-scoped: it returns only grants belonging to the authenticated tenant. Results are cursor-paginated. ## OpenAPI ````yaml /api-reference/openapi.yaml get /customers/{customerId}/grants openapi: 3.1.0 info: title: Feddi Partner API version: '2026-06-01' description: >- Operate a Feddi closed-loop wallet and loyalty program at the point of sale: identify customers, read balances, accept wallet payments, run top-ups, and reconcile transactions. All amounts are integer minor units with an explicit ISO-4217 currency. Balances are merchant-held and closed-loop. Every response uses a typed envelope (`ok` / `data` / `error` / `meta`) with string error codes (never a bare HTTP number) and an idempotency-replay flag. Authenticate with the `x-api-key` header; exchange it for a short-lived POS terminal JWT for hot-path calls. Self-validate against this document (`GET /openapi`) and read `GET /capabilities` for the credential types, currencies, and features enabled for your integration before assuming any enum. Operations are tagged `x-feddi-availability: ga` (stable) or `beta` (callable, contract may still change additively); confirm what is enabled for your credentials via `GET /capabilities`. Sandbox access is granted per partner agreement; request credentials from your Feddi contact. servers: - url: https://api.feddi.io/v1/partner description: production - url: https://api.dev.feddi.io/v1/partner description: dev security: - ApiKeyAuth: [] tags: - name: platform description: >- Platform cross-cutting: health, capabilities, openapi self-serve, merchant provisioning, settlement, reconciliation. - name: checkout_session description: >- Checkout sessions: every interaction opens a session, then identity and basket attach to it, and payment, top-up, and offers run against it. - name: auth description: >- Partner authentication + onboarding: API key lifecycle, POS terminal JWT exchange, terminal heartbeat. - name: customers description: >- Customer lookup + identification: resolve identity, cashier-panel summaries, preferences, GDPR export/erase. - name: enrollment description: >- Enrollment + signup: OTP enroll, cashback claims, identity/consent, customer correction + merge. - name: payments description: >- Payments + redemption: debit wallet (promo-first), balance-check, void, refund, QR mint. - name: topup description: >- Wallet top-up: 2-step prepare/confirm, reload-bonus grants, SKU top-up, settlement + reconciliation. - name: incentives description: >- Incentives + offers: offer feeds, apply/redeem/release locks, proposals, budget envelopes, points, grant clawback. - name: transactions description: >- Transactions + receipts: transaction detail, void, receipts, disputes, settlements, reconciliation, exports. - name: webhooks description: >- Webhooks + events: subscriptions, delivery history + retry, event catalog, polling fallback. paths: /customers/{customerId}/grants: get: tags: - incentives-offers summary: List a customer's promotional grants and their state-machine state description: >- Lists a customer's promotional-money grants and the lifecycle state of each. Each grant in the response includes its `source` (`CASHBACK`, `RELOAD_BONUS`, `SKU_TOPUP_BONUS`, or `GATEWAY_BONUS`), its `state` (`LOCKED`, `RELEASED`, `CLAWED_BACK`, or `EXPIRED`), its original amount, its remaining amount (`remaining_minor`), and its expiry. All amounts are integer minor units in the grant's explicit ISO-4217 currency. **Promotional money is a separate value class from the customer's spendable cash balance**: it expires, is never cashable out, and is spent before cash under promo-first ordering. A `CASHBACK` grant accrues in `LOCKED` state and does not become available until the customer registers (proves phone ownership) and the merchant's claim gate is satisfied; only then does it transition to `RELEASED`. Use this endpoint as the operational view of what bonus value a customer holds and in what state. This endpoint is read-only and tenant-scoped: it returns only grants belonging to the authenticated tenant. Results are cursor-paginated. operationId: listCustomerGrants parameters: - name: customerId in: path required: true description: The wallet identity id. schema: type: string format: uuid - name: state in: query required: false description: Filter by grant state. schema: type: string enum: - LOCKED - RELEASED - CLAWED_BACK - EXPIRED - name: cursor in: query required: false description: Opaque cursor (C7). schema: type: string - name: limit in: query required: false description: Max per page (default 50, max 100). schema: type: integer minimum: 1 maximum: 100 default: 50 responses: '200': description: The customer's promotional grants. content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: data: $ref: '#/components/schemas/PromoGrantList' example: ok: true data: customer_id: wu_4421 grants: - grant_id: pg_7781 source: CASHBACK state: LOCKED amount: amount_minor: 1000 currency: QAR remaining: amount_minor: 1000 currency: QAR accrued_at: '2026-06-01T12:00:00Z' expires_at: '2026-09-01T12:00:00Z' source_event_ref: pos:order:5512 next_cursor: null has_more: false error: null meta: request_id: req_bb11cc22 idempotency_replayed: false api_version: '2026-06-01' data_completeness_score: 80 decision_trace_id: null capabilities: {} '401': description: Missing/invalid JWT (`INVALID_API_KEY`). content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: error: $ref: '#/components/schemas/Error' '403': description: Key lacks grants read permission for this scope (`FORBIDDEN`). content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: error: $ref: '#/components/schemas/Error' '404': description: Customer not found / cross-enterprise (`NOT_FOUND`). content: application/json: schema: allOf: - $ref: '#/components/schemas/ResponseEnvelope' - type: object properties: error: $ref: '#/components/schemas/Error' security: - PosTerminalJWT: [] components: schemas: ResponseEnvelope: type: object description: >- The standard response envelope that every enveloped endpoint serializes through. `ok` is a boolean discriminator: when `ok` is `true`, the typed result is carried in `data`; when `ok` is `false`, a typed error object is returned instead. The `meta` object is uniform across the entire API surface. required: - ok - meta properties: ok: type: boolean data: type: - object - 'null' error: oneOf: - $ref: '#/components/schemas/Error' - type: 'null' meta: $ref: '#/components/schemas/Meta' PromoGrantList: type: object description: Cursor-paginated list of a customer's promotional grants. required: - customer_id - grants - has_more properties: customer_id: type: string grants: type: array items: $ref: '#/components/schemas/PromoGrant' next_cursor: type: - string - 'null' has_more: type: boolean Error: type: object description: >- The typed error object returned with every non-2xx response. `code` is a string enum (for example `WALLET_PROGRAM_AMBIGUOUS`, `CREDENTIAL_TYPE_UNSUPPORTED`, `INSUFFICIENT_FUNDS`, `IDEMPOTENCY_KEY_REUSED`, `CURRENCY_NOT_SUPPORTED`), **never a bare HTTP status number**. Inspect `code` for programmatic branching, not the HTTP status. Some codes echo the valid set in `details` so clients can present or reconcile the accepted values: for example `CREDENTIAL_TYPE_UNSUPPORTED` lists the supported credential types, `CURRENCY_NOT_SUPPORTED` lists the supported ISO-4217 currencies, and `WALLET_PROGRAM_AMBIGUOUS` lists the candidate `wallet_program_id` values that matched the request. required: - code - message properties: code: type: string enum: - INSUFFICIENT_FUNDS - INVALID_API_KEY - CREDENTIAL_TYPE_UNSUPPORTED - CURRENCY_NOT_SUPPORTED - IDEMPOTENCY_KEY_REUSED - WALLET_PROGRAM_AMBIGUOUS - REQUIRES_DYNAMIC_CREDENTIAL - NOT_FOUND - FORBIDDEN - VALIDATION_ERROR - RATE_LIMITED - CONFLICT - INTERNAL_SERVER_ERROR message: type: string details: type: object additionalProperties: true Meta: type: object description: >- The uniform response metadata block returned on every response. `data_completeness_score` is computed per call and reports the completeness of the returned data. `decision_trace_id` is present on responses that carry decision or insight output and can be used to correlate the response with its reasoning. `capabilities` is an additive, response-level array of hints advertising features the caller may use, and may be extended over time without notice. required: - request_id - api_version properties: request_id: type: string description: Feddi-issued correlation id for this response. idempotency_replayed: type: boolean description: True when this response was replayed from the idempotency store. api_version: type: string description: The single API version field. example: '2026-06-01' data_completeness_score: type: integer minimum: 0 maximum: 100 description: >- 0-100, computed per call (basket/identity/tax/category/consent presence). decision_trace_id: type: - string - 'null' description: Opaque trace id on intelligence-bearing responses; one per response. capabilities: type: object additionalProperties: true description: Additive response-level capability hints. PromoGrant: type: object description: >- A single promotional-money grant in the customer's promotional ledger. Promotional grants are cross-POS: a grant issued at one point-of-sale is spendable across all of the customer's eligible registers. Promotional money is **never cashable** and always carries an expiry. `CASHBACK`-type grants accrue in the `LOCKED` state and remain non-spendable until both the customer registers their wallet identity and the merchant's claim-gate condition is satisfied, at which point the grant transitions to the spendable state. Promotional balances spend before any cashable balance under promo-first, FIFO ordering. A grant moves through the `LOCKED`, `RELEASED`, `CLAWED_BACK`, and `EXPIRED` states. Grant amounts are expressed as minor-unit integers paired with an explicit ISO-4217 currency. required: - grant_id - source - state - amount properties: grant_id: type: string source: type: string enum: - CASHBACK - RELOAD_BONUS - SKU_TOPUP_BONUS - GATEWAY_BONUS - SIGNUP_BONUS description: What funded the grant. state: type: string enum: - LOCKED - RELEASED - CLAWED_BACK - EXPIRED description: >- State-machine state (LOCKED→RELEASED on claim; →CLAWED_BACK/EXPIRED terminal). amount: $ref: '#/components/schemas/Money' remaining: $ref: '#/components/schemas/Money' accrued_at: type: - string - 'null' format: date-time expires_at: type: - string - 'null' format: date-time description: When the grant expires unclaimed/unspent. source_event_ref: type: - string - 'null' description: >- Server-derived reference to the finalized source event (e.g. pos:order:5512). Money: type: object description: >- Server-authoritative monetary value. Always expressed as a minor-units integer paired with an explicit ISO-4217 `currency` code. This is a ledger and reporting shape used to report amounts and balances, **never a custody or stored-value token**. required: - amount_minor - currency properties: amount_minor: type: integer description: Amount in minor units (e.g. fils, cents). currency: type: string minLength: 3 maxLength: 3 description: ISO-4217 currency code. example: QAR securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Partner API key (platform- or merchant-scoped). Contract key-enforces context.merchant_id. PosTerminalJWT: type: http scheme: bearer bearerFormat: JWT description: >- POS terminal JWT minted by /auth/token; carries integrationId + terminal/cashier claims (server-trusted). ````