read.internal.customers

The tenant’s customers (paginated list, filter by status, with score/addresses/orders). Search by email/name requires the pii.read scope — without it the read refuses a search rather than answering an empty list. Internal face only (PII).

• Surface: GET /v1/read/internal/customers · MCP tool read.internal.customers
• Auth: ★ Internal read (operator) — a tenant credential is REQUIRED; requires the customer.admin.write scope. The tenant is resolved from the CALLER’s identity, never from store. Personal fields come back MASKED for an actor without pii.read (the shape is unchanged).

Params (JSON Schema)

{
  "properties": {
    "limit": {
      "default": 25,
      "maximum": 100,
      "minimum": 1,
      "type": "integer"
    },
    "offset": {
      "default": 0,
      "maximum": 9007199254740991,
      "minimum": 0,
      "type": "integer"
    },
    "q": {
      "type": "string"
    },
    "sort": {
      "enum": [
        "name_asc",
        "name_desc",
        "score_desc",
        "score_asc"
      ],
      "type": "string"
    },
    "status": {
      "enum": [
        "active",
        "anonymized"
      ],
      "type": "string"
    }
  },
  "type": "object"
}

Result (200)

Open (unknown) — this capability does not declare an output schema.

Errors

validation_failed (400) · not_found (404) · unauthorized (401) · forbidden (403)