# Rank products for the shopper

`POST https://stylor.ai/api/v1/shoppers/me/rank`

- Authentication: public API key, sent as `Authorization: Bearer sgpt-pk-…`
- Rate-limit resource: `api.v1.shoppers`
- Demo key: accepted
- Web page: https://stylor.ai/guides/rest/v1/shopper-rank

Puts any list of your products in the shopper's order: your list's own
order, moved by their taste as far as the profile has learnt it (a
profile with a dozen reactions moves it most). Use it on a category
page or your own search results. Up to 500 ids are read; without a
token, or with nothing learnt, the order is yours unchanged.

## Example request

```bash
curl -X POST "https://stylor.ai/api/v1/shoppers/me/rank" \
  -H "Authorization: Bearer $STYLOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "itemIds": [
    "701e5cee-41da-4e91-a688-69e8c8dd5fe3",
    "a342cbe3-965b-4055-8ac3-20f63103cade",
    "35a725c8-23fb-4009-a52a-2a778d2e504a"
  ]
}'
```

## Headers

- `X-Shopper-Token` (string): The shopper's profile token, from `auth/start`, `auth/verify` or any call that made a profile. Optional here. [example `"eyJ2IjoxLCJ0eXAiOiJwcm9maWxlIiwicCI6IjRmM2Ei…"`]

## Request body

Content type `application/json`, required.

- `itemIds` (array<string>, required): Your products, in your order. Duplicates are read once; only the first 500 are ranked.

### Examples

#### A category page

Three products in the order the page would show them.

```json
{
  "itemIds": [
    "701e5cee-41da-4e91-a688-69e8c8dd5fe3",
    "a342cbe3-965b-4055-8ac3-20f63103cade",
    "35a725c8-23fb-4009-a52a-2a778d2e504a"
  ]
}
```

## Responses

### 200

The same products, in the shopper's order.

Content type `application/json`:

- `items` (array<object>, required)
  - `itemId` (string, required): The product.
  - `score` (number, required): How well it fits their taste, about −1 to 1. `0` when nothing is learnt.
  - `reason` (string, nullable, required): Why it moved, when it moved for a reason worth saying ("Fits your black, relaxed tees."). Null otherwise.

Example:

```json
{
  "items": [
    {
      "itemId": "35a725c8-23fb-4009-a52a-2a778d2e504a",
      "score": 0.38,
      "reason": "Fits your dark, slim, jeans."
    },
    {
      "itemId": "701e5cee-41da-4e91-a688-69e8c8dd5fe3",
      "score": 0.05,
      "reason": null
    },
    {
      "itemId": "a342cbe3-965b-4055-8ac3-20f63103cade",
      "score": -0.12,
      "reason": null
    }
  ]
}
```

## Errors

Every error is a JSON object with an `error` string. Match on the status code; the message is written for people.

| Status | Message | When |
| --- | --- | --- |
| 400 | Request body must be valid JSON. | A body was sent and could not be parsed as JSON. |
| 400 | Request body must be a JSON object. | A body was sent and parsed to something other than a JSON object. |
| 401 | That shopper token is not valid here. Start a profile or sign in again. | `X-Shopper-Token` was sent but cannot be opened with this key. |
| 422 | itemIds must be a non-empty array. | `itemIds` is missing, not an array, or empty. |

### Shared authentication, quota and rate-limit errors

| Status | Message | When |
| --- | --- | --- |
| 401 | API key missing. | The `Authorization` header is absent, is not `Bearer <key>`, or the key does not have three dash-separated segments. |
| 401 | Authentication failed: public key is invalid or not recognized. | A public-key endpoint was called with a key that does not exist. |
| 401 | Authentication failed: private key provided instead of a public key. | A public-key endpoint was called with an `sgpt-sk-…` key. |
| 401 | Authentication failed: token is not recognized. | A private-key endpoint was called with a key whose lookup segment does not exist. |
| 401 | Authentication failed: private key is invalid. | A private-key endpoint was called with a key whose secret does not match. |
| 401 | Authentication failed: public key provided instead of a private key. | A private-key endpoint was called with an `sgpt-pk-…` key. |
| 401 | Authentication failed: bearer token format is invalid. | A private key was sent without its `::` lookup segment. |
| 401 | Authentication failed: API key could not be read. Regenerate the key. | The key's embedded organization data could not be decrypted or parsed. |
| 403 | This key does not have the "<scope>" scope. | A private-key endpoint was called with a key whose scopes do not include the one the endpoint needs. Nothing is counted against your quota. See Authentication. |
| 403 | This key's scopes do not cover this endpoint. | A key with scopes called a private endpoint that no scope grants yet. Give the key every scope to reach it. |
| 403 | Demo mode is not available for private-key routes. Demos are only supported with public API keys. | The demo key was sent to a private-key endpoint. |
| 403 | Demo mode is not supported on this API route. Check the documentation for available demo endpoints. | The demo key was sent to a public-key endpoint that opts out of demo mode. |
| 403 | No active subscription for this organization. | The organization that owns the key has no active subscription. |
| 403 | No quota found for organization "<organizationId>". | The organization has no quota record for the current billing period. |
| 403 | No entitlement for "<resource>". | The plan's quota template has no entry for this endpoint. |
| 403 | Access denied to "<resource>". | The plan's quota template turns this endpoint off. |
| 429 | Monthly quota exceeded for "<resource>" (<quota>/<quota> used). | The billing-period quota for this endpoint is exhausted. `Retry-After` gives the seconds until the period resets. |
| 429 | RPM limit exceeded for "<resource>" (<used>/<limit> used). | More than the allowed requests per minute were sent. `Retry-After` is 60. |
| 500 | Internal server error. | An unexpected failure on the server. The message is always this string; details are logged, never returned. Quota consumed by the request is refunded, as it is for every 5xx response. |