Kanorio

Business systems

Customers, Membership & Entitlements

One contact record per person, dynamic segments, passwordless customer sign-in and entitlements that decide who may access what.

Available

Every person who fills in a form, buys something or signs in becomes one contact. Kanorio merges their activity into that record instead of keeping separate lists per feature.

Core objects

  • Contacts. Name, email, phone, consent and tags, with the person's orders, submissions and course progress. Each contact can carry your own system's id (externalId, unique per site and set once) and flat metadata for integration fields, and has a sign-in status (accessStatus): a blocked contact cannot sign in, while orders and emails continue.
  • Segments. Saved filters over contacts that update themselves, for example everyone who bought a course this month.
  • Entitlements. Grants that give a contact access to something, such as a course or members-only articles. Purchases grant them automatically, and you can grant or revoke them yourself.
  • Customer sessions. Customers sign in with a one-time code and get a knr_cat_ token for the Customer API.

Membership, subscriptions, credits and entitlements are separate concepts in Kanorio. An entitlement only answers whether someone may access something; it is never used as a balance or a billing plan.

How the APIs fit

  • Manage contacts, segments and entitlements with the Management API.
  • Sign customers in and read their own data with the Customer API, or drop in <kanorio-account> (passkey, Google and email code, following the methods the site has turned on; GET /site lists them under customerAccess.methods).
  • Gated Content Delivery API reads use the customer's token to decide what to return.
  • Webhooks report contact changes (customers.contact.created, updated, merged, access_changed), marketing consent changes (customers.consent.updated) and entitlement grants and revocations. Contact payloads carry ids and field names only, never the email address or phone number; fetch the contact to read values.

What the APIs expose

  • Contacts & dynamic segments (external reference, metadata, sign-in status, manual merge)Available
    API
    Management API contacts.* (externalId, metadata, look-up by externalId), segments.*
    Hosted site
    /customers/contacts, /data/contacts, /data/segments
    Webhooks
    customers.contact.created, customers.contact.updated, customers.contact.merged, customers.contact.access_changed, customers.consent.updated, customers.form.submitted
  • Customer login (magic link / 6-digit code)Available
    API
    Customer POST /auth/challenge, POST /auth/verify → Bearer; GET /me; DELETE /session
    Elements
    <kanorio-login> (stores Bearer in localStorage, kanorio:login event)
    Hosted site
    /account/login
  • Entitlements (who may access what)Available
    API
    Management API entitlements.grant / revoke / list / check; Customer GET /access/:id
    Elements
    <kanorio-unit> shows locked / preview / not-released states
    Hosted site
    Backoffice contact → Access tab; /data/entitlements; /account/content
    Webhooks
    deliverables.entitlement.granted, deliverables.entitlement.revoked
  • Membership tiers (ranked segments & automatic perks)Planned
    API
    Planned (tiers.*)
    Hosted site
    Planned (/data/tiers)

API reference

Webhook events

  • customers.sharedSender.softCap · Fired once per day when sign-in code and similar emails sent from Kanorio's shared address exceed the site's daily soft cap; the bot check before sign-in is strengthened automatically. Nothing to do.
  • customers.sharedSender.paused · Fired when those emails are paused for the site because of bounces, complaints or unusual volume; passkey, Google and signed-in customers are unaffected. Kanorio reviews and restores sending.
  • customers.sharedSender.resumed · Fired when paused sign-in code emails resume after review.
  • customers.contact.created · Fired when a contact is created from any source (checkout, form, import, manual, customer sign-up). Identities are listed by kind only; the data never includes the email address or phone number.
  • customers.contact.updated · Fired when a contact's fields change (name, tags, note, locale, invoice preference, metadata, external reference, profile attributes). Lists the changed field names; fetch the contact to read the values.
  • customers.contact.merged · Fired when two contacts become one, either automatically (the same person arrived with another identity) or by the owner. mergedContactId no longer exists; move your references to contactId.
  • customers.contact.access_changed · Fired when the owner blocks or unblocks a customer's sign-in. BLOCKED revokes every session and refuses new sign-ins; orders, consent and emails are unaffected.
  • customers.consent.updated · Fired when a contact's marketing consent on one channel changes (subscribed, pending confirmation, unsubscribed, bounced, complained).
  • deliverables.entitlement.granted · Fired when a contact is granted access (Entitlement) to a deliverable or unit.
  • deliverables.entitlement.revoked · Fired when a contact's Entitlement is revoked (e.g. refund or manual revocation).

Elements

  • <kanorio-account> · Customer sign-in panel: passkey, Google and a 6-digit email code, in the order the site enables them; signed-in customers see the account menu. Stores the customer token in localStorage and fires kanorio:login and kanorio:logout.
  • <kanorio-login> · Deprecated alias of kanorio-account kept for pages that already embed it; same panel, same events.

Recent changes

  • 2026-11-03 Contacts: external references, metadata, sign-in status and contact webhooks
  • 2026-10-31 Contacts: contacts.update replaces contacts.update_tags_note and can set the name
  • 2026-10-27 entitlements.grant: bring-your-own payments (source EXTERNAL), idempotency keys
View the full changelog

For site owners

How to use this product in the dashboard is covered in the help center.

Open the help center