GET /v1/catalog/product-lines/owned

Authentication

Send an API key as a bearer token. This endpoint does not state a specific permission in the specification, so give your key the least it needs and check the response rather than assuming.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X GET https://api.zinndigital.com/v1/catalog/product-lines/owned \
  -H "Authorization: Bearer zdk_live_…"

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

The product lines the caller's organization has, or has ever had, something on — for narrowing a list of what they already own, never for choosing what to buy. ⚖️ **Owner, 2026-09-08:** *"in the filters it shows all product lines, even when they do not have any products in that line or never brought it, it should only show the hosting types they actually own or used so to speak."* Measured that morning on a real account with seven sites across **two** lines, the sites filter offered **sixteen**; fourteen of them could only narrow the list to nothing. A line is returned when the organization has a **site** on it — including `deleted` sites, so the deleted-sites screen stays filterable — **or** a **subscription** to a plan in it, in **any** status, cancelled included. A line paid for does not stop being theirs. An abandoned cart is not ownership and is excluded: it minted neither a site nor a subscription. ⛔ **Not the list to offer when somebody is BUYING.** Restricting a purchase flow to lines already owned means a customer can never buy their first line. Use `listProductLines` (or `listInAppProductLines`) for that. ⛔ **Authenticated and tenant-scoped**, unlike the other `/v1/catalog` reads: it is a fact about one organization's estate, computed over exactly the scope `listSites` reads (`sites.view`), so the filter and the rows it filters cannot disagree. Served `Cache-Control: no-store` — a shared cache in front of it would serve one organization's lines to the next caller. ⛔ Retired, internal and in-app-only lines are **not** filtered out here, unlike the public catalogue. Every code in the response is present because a row of theirs names it, so there is nothing to leak — and a retired line whose sites still exist must stay filterable, or those sites become unreachable by filter with nothing to tell the customer why.

Response

Errors this endpoint can return

401 · 403 · 429