---
title: "Every variant of one product"
method: GET
path: "/api/v1/product/{product_id}/variants"
tags: ["product"]
---

# Every variant of one product

`GET /api/v1/product/{product_id}/variants`

## Request

- Base URL: `https://api.app.tightly.io`
- URL: `https://api.app.tightly.io/api/v1/product/{product_id}/variants`
- Auth: HTTP bearer

The product's variants, three fields each: `variant_id`, `variant_title` and `sku`. It is the list to walk when you hold a product and need the variant ids underneath it.

Deliberately thin, and not paginated: every variant of the product is in one answer. For prices, costs, stock or dimensions per variant, read the variants table or one variant.

`sku` and `variant_title` are null where the catalogue has none; `variant_id` never is.

A product id that does not exist in this organisation is refused 404.

Scope: `products:read`.

## Path parameters

- `product_id` string, required

## Headers

- `Tightly-Version` string

## Response `200`

Every variant of the product, id, title and SKU.

- object
  - `data` GetProductVariantsPayload
    - `variants` ProductVariantItem[], required
      - `sku` string, nullable
      - `variant_id` string, required
      - `variant_title` string, nullable
  - `message` object: severity, service and desc.

## Other responses

- `401`: No usable key: malformed, unknown, revoked, expired or stopped. One refusal covers all five, because telling a caller which is which maps the surface for them.
- `403`: The key may not reach this operation. `scope_missing` when the key does not hold Products; `ip_not_allowed` when the caller's address is outside the key's allowlist. `plan_excludes` when the organisation's plan does not include the public API itself, which is sold with Essentials and is asked of every key minted under that gate. A key minted before the gate existed is never refused by it, whatever the plan holds. Products is ungated, so that is the only plan reason served here.
- `404`: No product in this organisation carries that id.
- `429`: The key has spent its allowance for this minute. 600 reads and 120 writes a minute, counted per key, refused calls included. `Retry-After` says how long to wait.
- `503`: The database is briefly out of reach, which is what a failover or a full connection pool looks like from outside. Wait the seconds `Retry-After` names and send the request again. A read is safe to repeat. A write is not, because the connection was lost in the middle of it, so read the object back before sending it a second time. Branch on the status rather than on `code`, which is `POSTGRES_UNAVAILABLE` from one of the two seams that raise this and `SERVICE_UNAVAILABLE` from the other.

---

[API](https://skmtc.dev/tightly/apis/tightly-api.md) · [All operations](https://skmtc.dev/tightly/apis/tightly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tightly/apis/tightly-api/revisions/199f7eb35afb?raw)