Custom Attributes for Customers

Custom attributes store properties or metadata that can be used to simplify integration and synchronization or enable new personalization workflows. You can use the Customer Custom Attributes API to define custom attributes that can be associated with customer profiles, such as Favorite Drink, Occupation, Last Check-In Date, and Entity ID. You can also use the API to retrieve and manage seller-defined custom fields.

Watch the following video to see how the API works:

A custom attribute obtains a key identifier, visibility setting, allowed data type, and other properties from a custom attribute definition. This relationship is shown in the following diagram:

A diagram showing how properties of a custom attribute definition are used by corresponding custom attributes.

After a customer-related custom attribute definition is created for a Square seller account, the custom attribute can be set for customer profiles in the seller's Customer Directory.

Link to section

Basic workflow

You can use the Customer Custom Attributes API to extend the Customer data model and associate seller-specific or application-specific information with customer profiles. For a high-level understanding of how you work with customer-related custom attributes, it's helpful to focus on three basic operations:

When you want to create a new customer-related custom attribute, you must first define its properties by calling CreateCustomerCustomAttributeDefinition.

The following example request defines a Favorite Drink custom attribute. The schema field indicates that the value of the custom attribute is a String.

Create customer custom attribute definition

The key identifier and visibility setting that you specify for the definition are also used by corresponding custom attributes. The visibility setting determines the access level that other applications (including the Customer Directory and other Square products) have to the definition and corresponding custom attributes.

After the custom attribute definition is created, you can set the custom attribute for any customer profile in the seller's Customer Directory.

The following example UpsertCustomerCustomAttribute request sets the Favorite Drink custom attribute using the customer_id and key. Note the following:

  • The key in the path is favorite-drink, which is the same key specified by the definition.
  • The value in the request body sets the custom attribute value for the customer profile. This value must conform to the data type specified by the schema field in the definition (for this example, a String).

Upsert customer custom attribute

Note

Square also provides the BulkUpsertCustomerCustomAttributes endpoint to update multiple custom attributes and customer profiles in a single request.

You can now retrieve the custom attribute to get the value that was set for the customer profile.

The following example RetrieveCustomerCustomAttribute request retrieves the Favorite Drink custom attribute for a customer profile using the customer_id and key:

Retrieve customer custom attribute

The value field in the following example represents the custom attribute value:

{ "custom_attribute": { "key": "favorite-drink", "version": 1, "updated_at": "2022-05-20T21:13:48Z", "value": "Double-shot breve", "created_at": "2022-05-20T21:13:48Z", "visibility": "VISIBILITY_READ_WRITE_VALUES" } }

You can include the with_definition query parameter to return the corresponding custom attribute definition in the same call. For example, you might want to retrieve the definition to get the custom attribute's data type or name.

Note

Square also provides the ListCustomerCustomAttributes endpoint to retrieve all the custom attributes associated with a customer profile.

Link to section

Supported operations

The Customer Custom Attributes API supports the following operations:

Link to section

Working with customer-related custom attribute definitions

Link to section

Working with customer-related custom attributes

Note

Working with custom attributes is different than working with native attributes on the Customer object (such as given_name and email_address) that are accessed using the Customers API. For example, custom attributes aren't returned in a RetrieveCustomer or ListCustomers response or managed using CreateCustomer or UpdateCustomer.

Link to section

Supported data types

The data type of a custom attribute is specified in the schema field of the custom attribute definition. For all data types except Selection, this field contains a simple URL reference to a schema object hosted on the Square CDN.

Customer-related custom attributes support the following data types:

  • String
  • Email
  • PhoneNumber
  • Address
  • Date
  • Boolean
  • Number
  • Selection

Note

Customer-related custom attributes don't support DateTime or Duration data types.

For information about defining the data type for a customer-related custom attribute, see Specifying the schema.

Link to section

Seller scope

A CreateCustomerCustomAttributeDefinition request is scoped to a specific seller. Creating a definition makes the corresponding custom attribute available to the customer profiles in the seller's Customer Directory.

To make the custom attribute available to other sellers, you must call CreateCustomerCustomAttributeDefinition on behalf of each target seller. To do so when using OAuth, call this endpoint for each seller using their access token.

The following diagram represents two sellers using identical favorite-drink custom attribute definitions to record their customers' favorite drink:

A diagram showing two sellers using the same custom attribute.

You can reuse the same key for your custom attribute definition across sellers. The key must be unique for your application but not for a given seller. However, if you provide a name, it must be unique (case-sensitive) across all visible customer-related custom attribute definitions for the seller.

Did you know?

To simplify management, you might want to keep all definitions that use the same key synchronized across seller accounts. Therefore, if you change a definition for one seller, you should consider making the same change for all other sellers.

Link to section

Access control

The application that creates a custom attribute definition is the definition owner. The definition owner always has READ and WRITE permissions to the definition and all instances of the corresponding custom attribute.

The visibility specified by a custom attribute definition determines how other applications that make calls on behalf of a seller can access the definition and corresponding custom attributes. This access control applies to third-party applications and Square products, such as the Customer Directory.

The following table shows the access permitted by each supported visibility setting.

Custom attribute
definition

Custom attribute
Visibility settingREADWRITEREADWRITE
VISIBILITY_HIDDEN (default)NoNoNo 1No
VISIBILITY_READ_ONLYYesNoYes 2No
VISIBILITY_READ_WRITE_VALUESYesNoYesYes
  1. All custom attributes are visible in the .csv file when the customer data is exported, including those set to VISIBILITY_HIDDEN. Sellers can generate this file using the Export Customers button in the Customer Directory.
  2. Customer-related custom attributes set to VISIBILITY_READ_ONLY aren't currently visible in the Customer Directory or Point of Sale application.
Link to section

Accessing custom attributes owned by other applications

To access custom attributes or definitions owned by other applications, the following conditions must be true:

  • The visibility field must be set to one of the following:

    • VISIBILITY_READ_ONLY - Allows other applications to view the definition and corresponding custom attributes.
    • VISIBILITY_READ_WRITE_VALUES - Additionally allows other applications to set the value of the custom attribute for customer profiles or delete the custom attribute from customer profiles.
  • The requesting application must use the qualified key for the following requests:

    • RetrieveCustomerCustomAttributeDefinition
    • UpsertCustomerCustomAttribute
    • BulkUpsertCustomerCustomAttributes
    • RetrieveCustomerCustomAttribute
    • DeleteCustomerCustomAttribute

    To obtain a qualified key, call ListCustomerCustomAttributeDefinitions or ListCustomerCustomAttributes. These endpoints return qualified keys for custom attribute definitions and custom attributes that are owned by other applications and visible to your application. For more information, see List customer custom attribute definitions and List customer custom attributes.

Note

You should be aware of the following considerations when using custom attributes that are owned by other applications:

  • If the visibility of a custom attribute definition is updated, the change propagates to all corresponding custom attributes within a couple seconds.
  • If a custom attribute definition is deleted, all corresponding custom attributes are also deleted from customer profiles.
Link to section

Webhooks

You can subscribe to receive notifications for customer-related custom attribute events. Each event provides two options that allow you to choose when Square sends notifications:

  • .owned event notifications are sent when changes are made to custom attribute definitions and custom attributes that are owned by your application. A custom attribute definition is owned by the application that created it. A custom attribute is owned by the application that created the corresponding custom attribute definition.
  • .visible event notifications are sent when changes are made to custom attribute definitions and custom attributes that are visible to your application. These changes apply to:
    • All custom attribute definitions and custom attributes owned by your application.
    • All other custom attribute definitions or custom attributes whose visibility setting is VISIBILITY_READ_ONLY or VISIBILITY_READ_WRITE_VALUES. This includes seller-defined custom attributes (also known as custom fields), which are always set to VISIBILITY_READ_WRITE_VALUES.

Notification payloads for both options contain the same information.

Link to section

Webhook events

Subscribe to the following events to receive notifications for changes to custom attribute definitions and custom attributes that are owned by your application:

EventPermissionDescription
customer.custom_attribute_definition.owned.createdCUSTOMERS_READA custom attribute definition was created by your application. The application that created the custom attribute definition is the owner of the definition and corresponding custom attributes.

This event replaces the deprecated customer.custom_attribute_definition.created event.
customer.custom_attribute_definition.owned.updatedCUSTOMERS_READA custom attribute definition owned by your application was updated. Note that only the definition owner can update a custom attribute definition.

This event replaces the deprecated customer.custom_attribute_definition.updated event.
customer.custom_attribute_definition.owned.deletedCUSTOMERS_READA custom attribute definition owned by your application was deleted. Note that only the definition owner can delete a custom attribute definition.

This event replaces the deprecated customer.custom_attribute_definition.deleted event.
customer.custom_attribute.owned.updatedCUSTOMERS_READA custom attribute owned by your application was created or updated for a customer profile.

This event replaces the deprecated customer.custom_attribute.updated event.
customer.custom_attribute.owned.deletedCUSTOMERS_READA custom attribute owned by your application was deleted from a customer profile.

This event replaces the deprecated customer.custom_attribute.deleted event.

Subscribe to the following events to receive notifications for changes to custom attribute definitions and custom attributes that are visible to your application. These .visible events include changes to all custom attribute definitions and custom attributes that are owned by your application, so you do not need to subscribe to an .owned event when you subscribe to the corresponding .visible event.

EventPermissionDescription
customer.custom_attribute_definition.visible.createdCUSTOMERS_READA custom attribute definition that's visible to your application was created.

This event replaces the deprecated customer.custom_attribute_definition.public.created event.
customer.custom_attribute_definition.visible.updatedCUSTOMERS_READA custom attribute definition that's visible to your application was updated.

This event replaces the deprecated customer.custom_attribute_definition.public.updated event.
customer.custom_attribute_definition.visible.deletedCUSTOMERS_READA custom attribute definition that's visible to your application was deleted.

This event replaces the deprecated customer.custom_attribute_definition.public.deleted event.
customer.custom_attribute.visible.updatedCUSTOMERS_READA custom attribute that's visible to your application was created or updated for a customer profile.

This event replaces the deprecated customer.custom_attribute.public.updated event.
customer.custom_attribute.visible.deletedCUSTOMERS_READA custom attribute that's visible to your application was deleted from a customer profile.

This event replaces the deprecated customer.custom_attribute.public.deleted event.

The deprecated .public events and replacement .visible events apply to a different set of events. For more information, see Deprecated webhooks.

Note

Upserting or deleting a custom attribute for a customer profile doesn't invoke a customer.updated webhook.

The following is an example customer.custom_attribute_definition.visible.created notification:

The following is an example customer.custom_attribute.visible.updated notification:

Note the following:

  • The .owned and .visible events are available for webhook subscriptions starting in Square version 2022-08-17. The deprecated events are available starting in Square version 2022-05-12.

  • The CUSTOMERS_READ permission is required to receive notifications about customer-related custom attribute events.

  • The key of the custom attribute definition or custom attribute in the notification is always the qualified key.

  • If you subscribe to the .owned and .visible options for the same event, Square sends both notifications for changes to custom attribute definitions and custom attributes owned by the subscribing application.

  • The value of the data.id in the notification depends on the affected object:

    • For custom attribute definition events, data.id is the qualified key.
    • For custom attribute events, data.id is generated using the qualified key and the ID of the affected customer profile. This data.id cannot be used directly with the Customer Custom Attributes API.

For more information about custom attribute webhooks, see Subscribing to webhooks. For more information about how to subscribe to events and validate notifications, see Square Webhooks Overview.

Link to section

Requirements and limitations

The following requirements, limitations, and other considerations apply when working with customer-related custom attributes:

  • Minimum Square version - Square version 2022-05-12 or higher is required to work with the Customer Custom Attributes API.

  • Sensitive data - Custom attributes are intended to store additional information or store associations with an entity in another system. Don't use custom attributes to store any PCI data, such as credit card details. PII is supported in custom attribute values, but applications that create or read this data should observe applicable privacy laws and data regulations such as requesting the hard deletion of custom attribute data when a GDPR request for erasure is received. Never store secret-level information in a custom attribute. The use of custom attributes is subject to developers adhering to the Square API Data Policy Disclosures.

  • Unsupported data types - You can only create customer-related custom attribute definitions that specify a schema for a supported data type. The following data types aren't supported for customer-related custom attributes:

    • DateTime
    • Duration
  • Search support in the Customers API - The custom_attribute filter can be used with the SearchCustomers endpoint to search customer profiles by custom attribute. However, custom attributes aren't included in the search results. To retrieve or list custom attributes for a customer profile based on a search, you can call RetrieveCustomerCustomAttribute or ListCustomerCustomAttributes using a customer ID from the result set. For more information, see Search by custom attributes.

  • Limits - A seller account can have a maximum of 100 customer-related custom attribute definitions per application.

  • Unique name - If the visibility of a customer-related custom attribute definition is VISIBILITY_READ_ONLY or VISIBILITY_READ_WRITE_VALUES, the name must be unique (case-sensitive) across all visible customer-related custom attribute definitions for the seller. This requirement is intended to help sellers differentiate between custom attributes that are visible in the Customer Directory and other Square products.

  • Maximum value for Number custom attributes - The absolute value of a Number-type custom attribute cannot exceed (2^63-1)/10^5, or 92233720368547.

  • OAuth permissions - Applications that use OAuth require CUSTOMER_READ or CUSTOMER_WRITE permission to work with customer-related custom attributes. For more information, see OAuth API Overview and Customer Custom Attributes.

    If a seller revokes the permissions of the application that created a custom attribute definition, or if the token expires, the application cannot access the definition or corresponding custom attributes until permissions are restored. However, the definition and custom attributes remain available to other applications according to the visibility setting.

  • Idempotency - Including an idempotency key in a request guarantees that the request is processed only once. The following endpoints allow you to specify an idempotency_key:

    • CreateCustomerCustomAttributeDefinition
    • UpdateCustomerCustomAttributeDefinition
    • UpsertCustomerCustomAttribute
    • BulkUpsertCustomerCustomAttributes

    Be sure to generate a unique idempotency key for each request. If an idempotency key is reused in requests to the same endpoint on behalf of the same seller, Square returns the response from the first request that was successfully processed using the key. Square doesn't process subsequent requests that use the same key, even if they contain different fields. For more information, see Idempotency.

Link to section

Migration notes

The following migration notes apply to the Customer Custom Attributes API.

Link to section

Deprecated webhooks

Deprecated in version: 2022-08-17
Retired in version: TBD

The following table lists deprecated webhook events and their replacements.

The .owned and .visible event types introduced in Square version 2022-08-17 enable you to subscribe to a single webhook event to receive all notifications related to the event. For example, a subscription to the customer.custom_attribute.visible.updated event includes notifications for the customer.custom_attribute.owned.updated event because the custom attributes owned by your application are also visible to your application.

The deprecated .public event types and replacement .visible event types apply to a different set of events. Both are invoked for changes to any custom attributes or definitions whose visibility is set to VISIBILITY_READ_ONLY or VISIBILITY_READ_WRITE_VALUES. In addition, .visible event types are invoked for changes to custom attributes or definitions that are owned by the subscribing application and set to VISIBILITY_HIDDEN.

The deprecated non-public event types and replacement .owned event types apply to the same set of events. Both are invoked for changes to custom attributes or definitions that are owned by the subscribing application. The names have been changed to clarify the scope.

For more information about .owned and .visible events, see Webhooks. For information about how to manage your webhooks subscriptions, see Subscribe to Event Notifications.

Link to section

See also