Migros App API

[thisfro]

Migros App

I tried accessing the API with public data of the website, but was not able to get all the necessary cookies. I realized that the app will need to send all of the required cookies to function, thus decrypted the requests.

I used <REDACTED> to indicate values that I omitted due to privacy reasons.

Dig into the apps logs

Using PCAPdroid I was able to decrypt the apps requests and payloads.

Retrieve a receipt

Using GET https://mobile-app.migros.ch/app/products/receipts/<REDACTED> HTTP/2.0
with headers

authorization: Bearer <REDACTED>
x-app-build: 439
x-app-ecom-toggle: true
x-app-migros-tracking-id: <REDACTED>
x-siren-version: 1
x-app-famigros-loyalty: false
x-app-cumulus-number: <REDACTED>
x-route-version: 2
x-app-migros-cooperative: national
x-app-login-id: <REDACTED>
x-feature-flags: receipts-all-types, receipts-cumulus-points, maat-inline-html, discounts-detail-entity, discounts-productlistholder, mgo-push-registration, maat-teaser-embed-webviews, maat-link-embed-webviews, cmd

I was able to retrieve the reciept

{
	"class": [
		"product.list"
	],
	"properties": {
		"title": "Gekaufte Produkte",
		"subtitle": "<REDACTED (DATE OF PURCHASE)> – M Märt Shop Ville Zürich HB",
		"disclaimer": "Es werden nur aktuell verfügbare Produkte angezeigt.",
		"tracking": {
			"screenName": "productlist/receipt",
			"campaignParent": ""
		},
		"scoresAvailable": true,
		"type": "products"
	},
	"entities": [
		{
			"class": [
				"product.list.section"
			],
			"properties": {
				"id": "BeSS_010113",
				"name": "Fertiggerichte, Menüs & Snacks",
				"description": "Fertiggerichte, Menüs & Snacks"
			},
			"entities": [
				{
					"class": [
						"product.thumbnail"
					],
					"properties": {
						"meta": {
							"isOwg": false
						},
						"id": "130447000000",
						"texts": {
							"price": "5.95",
							"originalPrice": "",
							"priceShoppingList": "CHF 5.95",
							"originalPriceShoppingList": "",
							"name": "V-Love Sandwich Bacon Style",
							"subtext": "200g",
							"description": "",
							"status": ""
						},
						"accessibleTexts": {
							"price": "5 Franken 95 Rappen",
							"originalPrice": ""
						},
						"price": {
							"current": 5.95,
							"original": 0,
							"points": 0,
							"varies": false
						},
						"styles": {
							"subtext": []
						},
						"status": {
							"likes": 0
						},
						"category": {
							"id": "BeSS_010113",
							"name": "Fertiggerichte, Menüs & Snacks",
							"sortOrder": 23
						}
					},
					"entities": [
						{
							"class": [
								"image"
							],
							"properties": {},
							"entities": [],
							"actions": [],
							"links": [
								{
									"rel": [
										"self"
									],
									"href": "//image.migros.ch/xxhdpi_pi_list/4a67b9bf6126c2e6f775a6fb32ab463908b99164/v-love-sandwich-bacon-style.jpg"
								}
							]
						}
					],
					"actions": [
						{
							"name": "product.actions.addtoshoppinglist",
							"href": "https://mobile-app.migros.ch/app/shoppinglist/:id/product/130447000000"
						},
						{
							"name": "product.detail.actions.like",
							"method": "PUT",
							"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
							"type": "application/json"
						},
						{
							"name": "product.detail.actions.dislike",
							"method": "DELETE",
							"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
							"type": "application/json"
						}
					],
					"links": [
						{
							"rel": [
								"self"
							],
							"href": "https://mobile-app.migros.ch/app/products/id/130447000000"
						},
						{
							"rel": [
								"hybrid"
							],
							"href": "https://hybrid-app.migros.ch/products/130447000000",
							"headers": {
								"accept-language": "de",
								"x-app-migros-cooperative": "national",
								"x-app-version": "",
								"x-app-build": "439",
								"x-device-id": "",
								"x-device-uuid": "",
								"x-device-os": "ios",
								"x-device-os-version": "Unknown"
							}
						}
					]
				}
			],
			"actions": [],
			"links": []
		}
	],
	"actions": [],
	"links": [
		{
			"rel": [
				"self"
			],
			"href": "https://mobile-app.migros.ch/discovery/products/receipts/20230921_155602_0150140_257_403"
		},
		{
			"rel": [
				"ratings"
			],
			"href": "https://mobile-app.migros.ch/app/products/ratings?ids=130447000000"
		}
	]
}

List of reciepts

To get a list of reciepts we can use https://mobile-app.migros.ch/order/receipts/list/2024-01-01 to get

{
	"class": [
		"receipt.list"
	],
	"properties": {},
	"entities": [
		{
			"class": [
				"receipt.thumbnail"
			],
			"properties": {
				"id": "<REDACTED>",
				"timestamp": "<REDACTED>+02:00",
				"storeName": "M Märt Shop Ville Zürich HB",
				"totalAmount": "5.95",
				"preciseTotalAmount": 595,
				"accessibilityLabel": "Kassenbon vom Montag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
				"cumulusPoints": "5.95",
				"preciseCumulusPoints": 595
			},
			"entities": [],
			"actions": [],
			"links": [
				{
					"rel": [
						"html"
					],
					"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
				},
				{
					"rel": [
						"products"
					],
					"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
				}
			]
		},
		{
			"class": [
				"receipt.thumbnail"
			],
			"properties": {
				"id": "<REDACTED>",
				"timestamp": "<REDACTED>+02:00",
				"storeName": "M Märt Shop Ville Zürich HB",
				"totalAmount": "5.95",
				"preciseTotalAmount": 595,
				"accessibilityLabel": "Kassenbon vom Donnerstag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
				"cumulusPoints": "5.95",
				"preciseCumulusPoints": 595
			},
			"entities": [],
			"actions": [],
			"links": [
				{
					"rel": [
						"html"
					],
					"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
				},
				{
					"rel": [
						"products"
					],
					"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
				}
			]
		}
	],
	"actions": [],
	"links": []
}

Cookies

The app-login-id seems to be the most important cookie. I'm not sure if this alone might be enough to access at least some data. It is noteworthy that this cookie is very short lived (couple of minutes). There are other cookies necessary to renew it every so often. This makes the whole approach very cumbersome and not usable for any real-world use for now. If we can figure out the renewal process, it might be a easy way to access the API.

[aliyss]

This is great. I want to add, that the Authorization: Bearer [token] will probably also be necessary. I assume the call doesn't work if you leave that out.

I'm having issues with PCAPDroid on my phone (because it keeps crashing the Migros App), so this is really appreciated.

[thisfro]

Ah yes, the bearer token is most certainly necessary