Ábyrg verslunFyrirtækiAldursskírteiniVefþjónustaAlgengar spurningar
Vefþjónusta

Locations

Manage the physical locations (stores, points of sale) in your tenant. Devices and employees are assigned to locations. A verification made on a device records the device's locationId, when it has one (see the device object on the Devices page).

The location object

  • id, createdAt (ISO 8601), updatedAt (epoch ms)
  • name, address, and, each left out when not set, address2, city, postcode, externalId

externalId is your own ID for the location (for example your POS location ID). It is unique among your tenant's locations, so you can push locations idempotently: look one up with ?externalId= before creating it. Deleting a location frees its externalId. Pagination, sorting and field formats follow the shared conventions.

Devices: the reads below accept device (DPoP) tokens, but a device's default scopes don't include locations:read, so most devices get 403. A device can always read its own locations from GET /api/v1/devices/{id}.

GET/api/v1/locations

List the locations in your tenant. Callers: service client (Bearer) and device (DPoP). Sorted by createdAt descending unless you pass sortBy. Without limit, every location is returned in one response; with limit, the response is a page with nextCursor and hasMore (nextCursor is null on the last page).

Headers

AuthorizationstringRequired

Bearer <access_token> (service client) or DPoP <access_token> (device). Requires locations:read.

DPoPstringOptional

Device callers only: the DPoP proof for this request, including ath.

Query Parameters

namestringOptional

Case-insensitive substring match on the name

externalIdstringOptional

Exact match on externalId

sortBystringOptional

"name" | "createdAt" | "updatedAt". Default "createdAt"

sortOrderstringOptional

"asc" | "desc". Default "desc"

limitintegerOptional

Page size, a positive integer

cursorstringOptional

nextCursor from the previous page

Examples

cURL

curl "https://abyrgverslun.is/api/v1/locations?sortBy=name&sortOrder=asc" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

{
  "data": [
    {
      "id": "jh7bq3r8t2w6y9u1i4o5p7a3s6d8f2gk",
      "createdAt": "2026-04-11T13:02:45.906Z",
      "name": "Kringlan",
      "address": "Kringlan 4-12",
      "address2": "2. hæð",
      "city": "Reykjavík",
      "postcode": "103",
      "updatedAt": 1775912565906
    },
    {
      "id": "jh72m4q9x1c8n3v5b6z0k2d7f4g9t1ra",
      "createdAt": "2026-03-02T09:14:27.512Z",
      "name": "Laugavegur",
      "address": "Laugavegur 26",
      "city": "Reykjavík",
      "postcode": "101",
      "updatedAt": 1772442867512
    }
  ]
}

Errors

  • 401 Missing, invalid or expired token, or a device token sent as Bearer.
  • 403 The token lacks locations:read.
  • 422 A query parameter failed validation (limit, sortBy or sortOrder).

Response format: Errors.

POST/api/v1/locations

Create a location. Callers: service client (Bearer) only; a device (DPoP) call gets 403. Returns 201 with the new location.

Headers

AuthorizationstringRequired

Bearer <access_token> (service client). Requires locations:write.

Content-TypestringRequired

application/json

Request Body

namestringRequired

1-100 characters

addressstringRequired

Street address, 1-200 characters

address2stringOptional

Second address line (floor, unit), up to 200 characters

citystringOptional

1-100 characters. Optional: address may hold the whole free-text address

postcodestringOptional

1-20 characters

externalIdstringOptional

Your own ID for the location, 1-100 characters, unique in your tenant

Examples

cURL

curl -X POST https://abyrgverslun.is/api/v1/locations \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Kringlan",
    "address": "Kringlan 4-12",
    "address2": "2. hæð",
    "city": "Reykjavík",
    "postcode": "103",
    "externalId": "store-12"
  }'

Response

// 201 Created
{
  "data": {
    "id": "jh7bq3r8t2w6y9u1i4o5p7a3s6d8f2gk",
    "createdAt": "2026-04-11T13:02:45.906Z",
    "name": "Kringlan",
    "address": "Kringlan 4-12",
    "address2": "2. hæð",
    "city": "Reykjavík",
    "postcode": "103",
    "externalId": "store-12",
    "updatedAt": 1775912565906
  }
}

Errors

  • 400 Body is not valid JSON.
  • 401 Missing, invalid or expired token.
  • 403 The token lacks locations:write, or the caller is a device.
  • 409 Another location in your tenant has this externalId.
  • 422 The body failed validation.

Response format: Errors.

GET/api/v1/locations/{id}

Read one location. Callers: service client (Bearer) and device (DPoP).

Headers

AuthorizationstringRequired

Bearer <access_token> (service client) or DPoP <access_token> (device). Requires locations:read.

DPoPstringOptional

Device callers only: the DPoP proof for this request, including ath.

Response

{
  "data": {
    "id": "jh7bq3r8t2w6y9u1i4o5p7a3s6d8f2gk",
    "createdAt": "2026-04-11T13:02:45.906Z",
    "name": "Kringlan",
    "address": "Kringlan 4-12",
    "address2": "2. hæð",
    "city": "Reykjavík",
    "postcode": "103",
    "updatedAt": 1775912565906
  }
}

Errors

  • 401 Missing, invalid or expired token, or a device token sent as Bearer.
  • 403 The token lacks locations:read.
  • 404 No location with this ID in your tenant: unknown, malformed, deleted, or another tenant's.

Response format: Errors.

PATCH/api/v1/locations/{id}

Update a location. Callers: service client (Bearer) only; a device (DPoP) call gets 403. Send only the fields you want to change; fields you leave out keep their values. Returns the updated location.

Headers

AuthorizationstringRequired

Bearer <access_token> (service client). Requires locations:write.

Content-TypestringRequired

application/json

Request Body

namestringOptional

1-100 characters

addressstringOptional

1-200 characters

address2stringOptional

Up to 200 characters

citystringOptional

1-100 characters

postcodestringOptional

1-20 characters

externalIdstringOptional

Your own ID for the location, 1-100 characters, unique in your tenant

Examples

cURL

curl -X PATCH https://abyrgverslun.is/api/v1/locations/jh7bq3r8t2w6y9u1i4o5p7a3s6d8f2gk \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "Kringlan 2. hæð" }'

Response

{
  "data": {
    "id": "jh7bq3r8t2w6y9u1i4o5p7a3s6d8f2gk",
    "createdAt": "2026-04-11T13:02:45.906Z",
    "name": "Kringlan 2. hæð",
    "address": "Kringlan 4-12",
    "address2": "2. hæð",
    "city": "Reykjavík",
    "postcode": "103",
    "updatedAt": 1778063472301
  }
}

Errors

  • 400 Body is not valid JSON.
  • 401 Missing, invalid or expired token.
  • 403 The token lacks locations:write, the caller is a device, or the ID belongs to another tenant.
  • 404 Unknown, malformed or deleted location ID.
  • 409 Another location in your tenant has this externalId.
  • 422 The body failed validation.

Response format: Errors.

DELETE/api/v1/locations/{id}

Delete a location. Callers: service client (Bearer) only; a device (DPoP) call gets 403. This is a soft delete: the location disappears from lists and reads, and from the locationIds and locations of the devices and employees assigned to it, but their assignments are not removed. A device whose locationId is this location keeps it, so that device's new transactions still carry this location's ID. Past transactions are unchanged. Deleting the same location again returns 404.

Headers

AuthorizationstringRequired

Bearer <access_token> (service client). Requires locations:delete or locations:write.

Response

{ "deleted": true }

Errors

  • 401 Missing, invalid or expired token.
  • 403 The token lacks both locations:delete and locations:write, the caller is a device, or the ID belongs to another tenant.
  • 404 Unknown, malformed or already deleted location ID.

Response format: Errors.