Deactivate Promotion Code - Waffo Pancake

Deactivate a promotion code. Buyers can no longer redeem it, and its code is released immediately: a new promotion code or coupon in the same store and environment can use it.

POST /v1/actions/promotion-code/deactivate-promotion-code

Authentication: API Key

Deactivation is permanent. An inactive promotion code cannot be reactivated. To offer the code again, create a new promotion code with it.

Request Body

Field	Type	Required	Description
`id`	string	Yes	Promotion code ID (Short ID format `PMC_xxx`)

Example Request

const { promotionCode } = await client.promotionCodes.deactivate({ id: "PMC_6eYCunG3IMmIgcQOnaXdoA" });
console.log(promotionCode.status); // => "inactive"

MERCHANT_ID="MER_2aUyqjCzEIiEcYMKj7TZtw"
TIMESTAMP=$(date +%s)
BODY='{"id":"PMC_6eYCunG3IMmIgcQOnaXdoA"}'
BODY_HASH=$(echo -n "$BODY" | openssl dgst -sha256 -binary | base64 | tr -d '\n')
CANONICAL_REQUEST="POST
/v1/actions/promotion-code/deactivate-promotion-code
$TIMESTAMP
$BODY_HASH"

SIGNATURE=$(echo -n "$CANONICAL_REQUEST" | openssl dgst -sha256 -sign private_key.pem | base64 | tr -d '\n')

curl -X POST "https://api.waffo.ai/v1/actions/promotion-code/deactivate-promotion-code" \
  -H "Content-Type: application/json" \
  -H "X-Merchant-Id: $MERCHANT_ID" \
  -H "X-Timestamp: $TIMESTAMP" \
  -H "X-Signature: $SIGNATURE" \
  -d "$BODY"

import hashlib, time, base64, json, requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

merchant_id = "MER_2aUyqjCzEIiEcYMKj7TZtw"
timestamp = str(int(time.time()))
body = {"id": "PMC_6eYCunG3IMmIgcQOnaXdoA"}

body_json = json.dumps(body, separators=(",", ":"))
body_hash = base64.b64encode(hashlib.sha256(body_json.encode()).digest()).decode()
path = "/v1/actions/promotion-code/deactivate-promotion-code"
canonical = f"POST\n{path}\n{timestamp}\n{body_hash}"

with open("private_key.pem", "rb") as f:
    private_key = serialization.load_pem_private_key(f.read(), password=None)

signature = base64.b64encode(
    private_key.sign(canonical.encode(), padding.PKCS1v15(), hashes.SHA256())
).decode()

resp = requests.post(
    f"https://api.waffo.ai{path}",
    headers={
        "Content-Type": "application/json",
        "X-Merchant-Id": merchant_id,
        "X-Timestamp": timestamp,
        "X-Signature": signature,
    },
    data=body_json,
)
print(resp.json())

Success Response (200)

{
  "data": {
    "promotionCode": {
      "id": "PMC_6eYCunG3IMmIgcQOnaXdoA",
      "couponId": "CPN_5dXBtmF2HLlHfbPNm0Wcnz",
      "code": "KOL-ALICE",
      "status": "inactive",
      "restrictions": {
        "customerEmails": [],
        "perCustomerLimit": null,
        "maxRedemptions": 100,
        "expiresAt": "2026-12-01T00:00:00.000Z",
        "minimumAmount": { "USD": "50.00" }
      },
      "batchId": null,
      "createdAt": "2026-11-02T08:00:00.000Z"
    }
  }
}

Response Fields

Same as Create Promotion Code response.

Existing orders keep the code they were placed with and are not affected. Deactivating an already inactive promotion code returns 200 with it unchanged. Deactivating a promotion code never deactivates its coupon. The coupon’s own code can only be deactivated by deactivating the coupon, which also stops all its promotion codes.

Errors

Retry policy: Never retry 4xx — fix the request and resubmit. Retry 5xx with exponential backoff (start 5s, max 3 attempts).

Status	`errors[0].message`	What it means	Recommended handling
400	`Missing or invalid header: x-context-environment`	Environment header is missing or not `test` / `prod`	Set `X-Environment` to `test` or `prod`
400	`Invalid JSON body`	The body is not valid JSON	Fix the body, resubmit
400	`Missing required field: id`	`id` was omitted	Add `id`, resubmit
400	`Expected format: PMC_xxx, got "X"`	`id` is not a valid Short ID	Use a `PMC_` prefixed Short ID
401	`Authentication required`	Authentication failed	Verify API key, timestamp, and signature
404	`Promotion code not found`	The promotion code does not exist, belongs to another merchant, or is in the other environment	Verify the `id` and the environment of your API key
409	`The coupon's own code can only be deactivated together with the coupon`	The ID is the coupon’s own code, not one of its promotion codes	Deactivate the coupon instead
500	`Internal server error`	Unexpected server-side failure	Retry with exponential backoff (start 5s, max 3 attempts)

⌘I