Migros App API #1
Description
Migros App
I tried accessing the API with public data of the website, but was not able to get all the necessary cookies. I realized that the app will need to send all of the required cookies to function, thus decrypted the requests.
I used <REDACTED> to indicate values that I omitted due to privacy reasons.
Dig into the apps logs
Using PCAPdroid I was able to decrypt the apps requests and payloads.
Retrieve a receipt
Using GET https://mobile-app.migros.ch/app/products/receipts/<REDACTED> HTTP/2.0
with headers
authorization: Bearer <REDACTED>
x-app-build: 439
x-app-ecom-toggle: true
x-app-migros-tracking-id: <REDACTED>
x-siren-version: 1
x-app-famigros-loyalty: false
x-app-cumulus-number: <REDACTED>
x-route-version: 2
x-app-migros-cooperative: national
x-app-login-id: <REDACTED>
x-feature-flags: receipts-all-types, receipts-cumulus-points, maat-inline-html, discounts-detail-entity, discounts-productlistholder, mgo-push-registration, maat-teaser-embed-webviews, maat-link-embed-webviews, cmdI was able to retrieve the reciept
{
"class": [
"product.list"
],
"properties": {
"title": "Gekaufte Produkte",
"subtitle": "<REDACTED (DATE OF PURCHASE)> – M Märt Shop Ville Zürich HB",
"disclaimer": "Es werden nur aktuell verfügbare Produkte angezeigt.",
"tracking": {
"screenName": "productlist/receipt",
"campaignParent": ""
},
"scoresAvailable": true,
"type": "products"
},
"entities": [
{
"class": [
"product.list.section"
],
"properties": {
"id": "BeSS_010113",
"name": "Fertiggerichte, Menüs & Snacks",
"description": "Fertiggerichte, Menüs & Snacks"
},
"entities": [
{
"class": [
"product.thumbnail"
],
"properties": {
"meta": {
"isOwg": false
},
"id": "130447000000",
"texts": {
"price": "5.95",
"originalPrice": "",
"priceShoppingList": "CHF 5.95",
"originalPriceShoppingList": "",
"name": "V-Love Sandwich Bacon Style",
"subtext": "200g",
"description": "",
"status": ""
},
"accessibleTexts": {
"price": "5 Franken 95 Rappen",
"originalPrice": ""
},
"price": {
"current": 5.95,
"original": 0,
"points": 0,
"varies": false
},
"styles": {
"subtext": []
},
"status": {
"likes": 0
},
"category": {
"id": "BeSS_010113",
"name": "Fertiggerichte, Menüs & Snacks",
"sortOrder": 23
}
},
"entities": [
{
"class": [
"image"
],
"properties": {},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"self"
],
"href": "//image.migros.ch/xxhdpi_pi_list/4a67b9bf6126c2e6f775a6fb32ab463908b99164/v-love-sandwich-bacon-style.jpg"
}
]
}
],
"actions": [
{
"name": "product.actions.addtoshoppinglist",
"href": "https://mobile-app.migros.ch/app/shoppinglist/:id/product/130447000000"
},
{
"name": "product.detail.actions.like",
"method": "PUT",
"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
"type": "application/json"
},
{
"name": "product.detail.actions.dislike",
"method": "DELETE",
"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
"type": "application/json"
}
],
"links": [
{
"rel": [
"self"
],
"href": "https://mobile-app.migros.ch/app/products/id/130447000000"
},
{
"rel": [
"hybrid"
],
"href": "https://hybrid-app.migros.ch/products/130447000000",
"headers": {
"accept-language": "de",
"x-app-migros-cooperative": "national",
"x-app-version": "",
"x-app-build": "439",
"x-device-id": "",
"x-device-uuid": "",
"x-device-os": "ios",
"x-device-os-version": "Unknown"
}
}
]
}
],
"actions": [],
"links": []
}
],
"actions": [],
"links": [
{
"rel": [
"self"
],
"href": "https://mobile-app.migros.ch/discovery/products/receipts/20230921_155602_0150140_257_403"
},
{
"rel": [
"ratings"
],
"href": "https://mobile-app.migros.ch/app/products/ratings?ids=130447000000"
}
]
}List of reciepts
To get a list of reciepts we can use https://mobile-app.migros.ch/order/receipts/list/2024-01-01 to get
{
"class": [
"receipt.list"
],
"properties": {},
"entities": [
{
"class": [
"receipt.thumbnail"
],
"properties": {
"id": "<REDACTED>",
"timestamp": "<REDACTED>+02:00",
"storeName": "M Märt Shop Ville Zürich HB",
"totalAmount": "5.95",
"preciseTotalAmount": 595,
"accessibilityLabel": "Kassenbon vom Montag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
"cumulusPoints": "5.95",
"preciseCumulusPoints": 595
},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"html"
],
"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
},
{
"rel": [
"products"
],
"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
}
]
},
{
"class": [
"receipt.thumbnail"
],
"properties": {
"id": "<REDACTED>",
"timestamp": "<REDACTED>+02:00",
"storeName": "M Märt Shop Ville Zürich HB",
"totalAmount": "5.95",
"preciseTotalAmount": 595,
"accessibilityLabel": "Kassenbon vom Donnerstag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
"cumulusPoints": "5.95",
"preciseCumulusPoints": 595
},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"html"
],
"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
},
{
"rel": [
"products"
],
"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
}
]
}
],
"actions": [],
"links": []
}Cookies
The app-login-id seems to be the most important cookie. I'm not sure if this alone might be enough to access at least some data. It is noteworthy that this cookie is very short lived (couple of minutes). There are other cookies necessary to renew it every so often. This makes the whole approach very cumbersome and not usable for any real-world use for now. If we can figure out the renewal process, it might be a easy way to access the API.