---
title: "List rewards"
method: GET
path: "/v1/projects/{project}/referral-rewards"
tags: ["Referral Program"]
---

# List rewards

`GET /v1/projects/{project}/referral-rewards`

## Request

- Base URL: `https://api.subscriby.net`
- URL: `https://api.subscriby.net/v1/projects/{project}/referral-rewards`
- Auth: HTTP bearer

```bash
curl "https://api.subscriby.net/v1/projects/7f3d1c92-8b45-4e6a-9d21-5c8e0a4b6f13/referral-rewards?affiliate_id=0b1c2d3e-4f50-4617-8a9b-0c1d2e3f4a5b&status=approved" \
  -H "Authorization: Bearer sbt_..."
```

Pages the ledger, newest first: one row per settled payment per side of a referral. `affiliate_id`, `status` (`pending`, `approved`, `paid`, `applied`, `reversed`) and `beneficiary` (`referrer`, `friend`) narrow it. A reversal is a row of its own with a negative `amount` and `reverses_reward_id` naming the reward it cancels. The ledger is read-only: rewards are written when a payment settles, made payable by the hold, paid by a recorded payout and reversed by a refund.

## Path parameters

- `project` string, uuid, required

## Query parameters

- `affiliate_id` string, uuid
- `status` 'pending' | 'approved' | 'paid' | 'reversed' | 'applied': Where a reward row stands. Cash moves `Pending` → `Approved` → `Paid`, or to `Reversed` when the payment behind it is refunded before it was paid out; days move `Pending` (waiting on the affiliate's balance) → `Applied` (banked on a purchase).
- `beneficiary` 'referrer' | 'friend': Who a reward row is for: the member who referred, or the member who was referred.
- `page` integer
- `per_page` integer
- `sort_by` string
- `sort_direction` 'asc' | 'desc'
- `limit` integer

## Response `200`

The page.

- object
  - `data` ReferralRewardResource[], required: The items on this page.
    - `id` string, required: The reward's id.
    - `project_id` string, required: The project the programme belongs to.
    - `program_id` string, required: The programme it was earned under.
    - `affiliate_id` string, required: The affiliate whose referral earned it.
    - `referral_id` string, required: The referral it was earned on.
    - `payment_id` string, nullable, required: The settled payment that earned it; null on a reversal.
    - `beneficiary` string, required: `referrer` or `friend`.
    - `kind` string, required: `free_days` or `cash`.
    - `days` integer, nullable, required: The days, on a `free_days` reward; null on a cash one.
    - `amount` string, nullable, required: The money as a decimal string with four places, on a `cash` reward; negative on a reversal. Null on a days reward.
    - `currency_id` string, nullable, required: The currency of a cash reward; null on a days reward.
    - `currency` string, nullable: That currency's ISO 4217 code, present when the relation is loaded.
    - `status` string, required: `pending` (inside the hold, or days waiting on the balance), `approved` (payable), `paid` (recorded in a payout), `applied` (days banked on a membership) or `reversed` (taken back by a refund).
    - `hold_until` string, nullable, required: When a held cash reward becomes payable, ISO 8601; null otherwise.
    - `approved_at` string, nullable, required: When it became payable, ISO 8601.
    - `paid_at` string, nullable, required: When a payout recorded it, ISO 8601.
    - `reversed_at` string, nullable, required: When a refund reversed it, ISO 8601.
    - `applied_subscription_id` string, nullable, required: The membership the days were banked on; null until applied or on a cash reward.
    - `reverses_reward_id` string, nullable, required: On a reversal row, the reward it cancels.
    - `payout_id` string, nullable, required: The payout that paid it; null until then.
    - `created_at` string, nullable, required: When the row was written, ISO 8601.
  - `links` object, required: Links to the first, last, previous and next pages.
    - `first` string, nullable, required: The first page's URL.
    - `last` string, nullable, required: The last page's URL.
    - `prev` string, nullable, required: The previous page's URL; null on the first page.
    - `next` string, nullable, required: The next page's URL; null on the last page.
  - `meta` object, required: The paging counters for this page.
    - `current_page` integer, required: The page returned, 1-indexed.
    - `from` integer, nullable, required: The 1-indexed position of this page's first item across every page; null when the page is empty.
    - `last_page` integer, required: How many pages there are.
    - `links` object[], required: Generated paginator links.
      - `url` string, nullable, required: The page's URL; null for the ellipsis and the disabled arrows.
      - `label` string, required: The link's label: a page number, the previous or next arrow, or an ellipsis.
      - `active` boolean, required: Whether this link is the current page.
    - `path` string, nullable, required: Base path for paginator generated URLs.
    - `per_page` integer, required: Number of items shown per page.
    - `to` integer, nullable, required: Number of the last item in the slice.
    - `total` integer, required: Total number of items being paginated.

## Other responses

- `401`: `AUTHENTICATION_REQUIRED`: the request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an `sbt_test_` token on production).
- `403`: `TOKEN_MISSING_ABILITY`: the token is valid but does not carry the ability this endpoint requires; `error.context.required_ability` names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers `FORBIDDEN`, `TEAM_TIER_REQUIRED` or `CONNECTOR_TIER_REQUIRED` with the same status, and says so in its own description.
- `404`: `RESOURCE_NOT_FOUND`: an id in the path names nothing the token can see. `TENANT_MISMATCH`: the project sits outside the token's `scope:project:` allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
- `422`: `VALIDATION_FAILED`: the payload broke a rule, and `error.fields` maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with `error.message` saying why and no `fields`.
- `429`: `RATE_LIMITED`: the token has spent its 300 requests a minute or 10,000 an hour; `Retry-After` says when the next one is accepted.

---

[API](https://skmtc.dev/memberpass/apis/subscriby-rest-api.md) · [All operations](https://skmtc.dev/memberpass/apis/subscriby-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/memberpass/apis/subscriby-rest-api/revisions/59c4df91d764?raw)