> ## Documentation Index > Fetch the complete documentation index at: https://docs.shoply.gg/llms.txt > Use this file to discover all available pages before exploring further. # Hide or show what an order delivered > Hides the order's license keys, files and instructions from its buyer for this dispute, on the order's page, in the customer panel and at its download links, or shows them again. What was emailed cannot be taken back. A dispute that is won shows them again by itself. Needs the `disputes.write` permission (Answer Disputes). ## OpenAPI ````yaml /api-reference/openapi.json post /stores/{storeId}/disputes/{disputeId}/access openapi: 3.1.0 info: title: Shoply API version: '1' description: >- Everything a store's own server can do with a secret API key: its catalogue, orders, customers, marketing, finance and the rest of what the dashboard does. And the Customer API, which a buyer's own device asks with a token of theirs. servers: - url: https://api.shoply.gg/v1 security: - apiKey: [] tags: - name: API key - name: Store - name: Domain - name: Payment methods - name: Analytics - name: Storefronts - name: Storefront code - name: Payment Routing - name: Custom payment methods - name: Products - name: Product pictures - name: Stock - name: Categories - name: Upsells - name: Subscriptions - name: Orders - name: Invoices - name: Reviews - name: Coupons - name: Coupon categories - name: Coupon pop-up - name: Sales - name: Blog - name: Search settings - name: Redirects - name: Sitemap - name: Cart Recovery - name: Email Marketing - name: Email Templates - name: Customers - name: Affiliates - name: Support Tickets - name: Blacklist - name: Fraud protection - name: Disputes - name: Finance - name: Tax - name: Expenses - name: Expense setup - name: API requests - name: Webhook endpoints - name: Webhook deliveries - name: Customer API paths: /stores/{storeId}/disputes/{disputeId}/access: post: tags: - Disputes summary: Hide or show what an order delivered description: >- Hides the order's license keys, files and instructions from its buyer for this dispute, on the order's page, in the customer panel and at its download links, or shows them again. What was emailed cannot be taken back. A dispute that is won shows them again by itself. Needs the `disputes.write` permission (Answer Disputes). operationId: disputes.access parameters: - name: storeId in: path required: true description: >- The store's ID. A key reaches the store it was made in: `GET /key` answers which. schema: type: string - name: disputeId in: path required: true description: The dispute, by its ID. schema: type: string - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object properties: hidden: type: boolean description: True to hide them, false to show them again. required: - hidden responses: '200': description: It worked. content: application/json: schema: type: object properties: success: type: boolean message: nullable: true code: nullable: true data: type: object properties: id: type: string orderId: type: string email: type: string provider: type: string providerName: type: string externalId: type: string reason: type: string reasonText: type: string stage: type: string providerStatus: type: string status: type: string amount: type: integer currency: type: string dueAt: type: string answer: type: object properties: state: type: string at: nullable: true by: type: string note: type: string answeredFrom: type: string answerPlace: type: string accessTaken: type: boolean dateCreated: type: string dateClosed: nullable: true order: type: object properties: id: type: string status: type: string amount: type: integer currency: type: string dateCreated: type: string can: type: object properties: edit: type: boolean submit: type: boolean accept: type: boolean markSubmitted: type: boolean records: type: array items: type: object properties: key: type: string title: type: string facts: type: array items: type: object properties: key: type: string name: type: string value: type: string strong: type: boolean activity: type: array items: type: string draft: type: object properties: decision: type: string contacted: type: string used: type: string words: type: string saved: type: boolean statement: type: string files: type: - array - object after: type: array items: type: object properties: key: type: string done: type: boolean text: type: string history: type: array items: type: object properties: at: type: string what: type: string detail: type: string example: success: true message: null code: null data: id: ae36fc25-3cea-4d17-acaa-4bdb43d84a0e orderId: 71ed606f-3119-4f9f-b7f7-ecd25740e15b email: mila@example.com provider: stripe providerName: Stripe externalId: dp_1QdZ8x2eZvKYlo2C reason: fraudulent reasonText: Says they did not make the payment stage: chargeback providerStatus: needs_response status: needs_response amount: 49 currency: USD dueAt: '2026-10-27T16:20:19Z' answer: state: draft at: null by: '' note: '' answeredFrom: provider answerPlace: your Stripe Dashboard accessTaken: true dateCreated: '2026-10-22T16:20:19Z' dateClosed: null order: id: 71ed606f-3119-4f9f-b7f7-ecd25740e15b status: completed amount: 49 currency: USD dateCreated: '2026-10-10T16:20:19Z' can: edit: true submit: false accept: false markSubmitted: true records: - key: buyer title: The Buyer facts: - key: email name: Email value: mila@example.com strong: false - key: name name: Name value: Mila Kowalski strong: false - key: order title: The Order facts: - key: placed name: Placed value: Oct 10, 2026, 4:20 PM UTC strong: false - key: paid name: Paid value: >- Oct 10, 2026, 4:20 PM UTC · $49.00 · Credit/Debit Card (Stripe) strong: false activity: - >- 2026-10-19 16:20 UTC · Opened their order (order page) · 203.0.113.42 (the address they paid from) · Germany · Chrome on Windows draft: decision: fight contacted: 'no' used: 'yes' words: >- The buyer bought a license key and opened their order again from the address they paid from. saved: true statement: >- The buyer bought a license key and opened their order again from the address they paid from. The buyer did not contact the store before disputing the payment. What they bought was used. What the store's records show: - Email: mila@example.com - Name: Mila Kowalski - Billing Address: Berlin, Germany - Checkout From: 203.0.113.42 · Germany · Chrome on Windows - Placed: Oct 10, 2026, 4:20 PM UTC … files: [] after: - key: blacklist done: false text: The buyer is not blacklisted - key: access done: true text: Their keys and files are hidden from them history: - at: '2026-10-19T16:20:19Z' what: The buyer opened their order detail: 203.0.113.42, Germany '401': $ref: '#/components/responses/NoKey' '403': $ref: '#/components/responses/NotAllowed' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/Refused' '429': $ref: '#/components/responses/TooMany' x-codeSamples: - lang: javascript label: Node.js source: | import Shoply from "@shoplygg/node"; const shoply = new Shoply({ apiKey: process.env.SHOPLY_API_KEY }); const result = await shoply.disputes.access("DISPUTE_ID", { hidden: true, }); - lang: php label: PHP source: | getenv('SHOPLY_API_KEY')]); $result = $shoply->disputes->access('DISPUTE_ID', [ 'hidden' => true, ]); - lang: python label: Python source: | import shoply client = shoply.Client() # reads SHOPLY_API_KEY result = client.disputes.access("DISPUTE_ID", hidden=True) components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- A word of your own for this one change, up to 180 letters, digits, dots, dashes, underscores and colons. Sent again with the same key, the request is not carried out twice: the first answer comes back, with `Idempotent-Replay: true`. schema: type: string responses: NoKey: description: >- No API key was sent, or the one sent is not a live key: `api_key_required`, `invalid_api_key`. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotAllowed: description: >- The key is real and may not do this: `missing_scope` (with `requiredScope`), `ip_not_allowed`, `account_unavailable`, or `dashboard_only` for something only a person in the dashboard may do. content: application/json: schema: $ref: '#/components/schemas/Refusal' NotFound: description: >- There is no such thing in this store: `not_found`. A store that is not the key's own is answered the same way. content: application/json: schema: $ref: '#/components/schemas/Refusal' Refused: description: >- The request was understood and not carried out. `validation_failed` says what is wrong with each field under `errors`; other codes are the route's own. content: application/json: schema: $ref: '#/components/schemas/Refusal' TooMany: description: >- The key has used up its budget for now: `rate_limited`. `Retry-After` says how many seconds to wait. content: application/json: schema: $ref: '#/components/schemas/Refusal' schemas: Refusal: type: object properties: success: type: boolean example: false message: type: string description: What is wrong, in words for a person. code: type: string description: What is wrong, as a word that does not change. data: nullable: true errors: type: object description: >- For `validation_failed`: what is wrong with each field, by the field's name. additionalProperties: type: string required: - success - message - code securitySchemes: apiKey: type: http scheme: bearer description: >- A secret API key, made under Developers in the dashboard: `Authorization: Bearer shoply_sk_...` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.