Returns members matching the given email, including their memberships and cards. Because the response contains personal data, this endpoint requires a bearer access token in the Authorization header, in addition to the x-entria store header used by every endpoint. Obtain a token from POST /oauth/token; it must have been issued for the same store as this request.
Short-lived access token for endpoints that return personal data. Obtain one from POST /oauth/token (RFC 7523 JWT-bearer), signing the assertion with the private key of the key pair registered for your store. Sent as Authorization: Bearer <token>. This is separate from the x-entria store header, which is still required.
Identifies which store this request is for. Required on every store-scoped route. It is not authentication and not a secret — it grants no privileges and is safe to send from a browser. You receive the value once your Entria backend has been created and configured. Missing header returns 400; an unknown store returns 404.