# GET /api/favorites/user

List the operating user's favorites, bucketed by whether they match the current operating context.

Results are split into two buckets: `inContext` (favorites whose stored scope matches the request's
operating context) is always populated; `outOfContext` is populated only when
WinkPG.Favorites.GetUserFavoritesInput.IncludeAllContexts is `true`, otherwise it is empty.


This read also performs lazy upkeep: each favorite is re-validated against the owning entity's current
authorization and visibility, and any pin the user can no longer see (entity deleted, access revoked) is
quietly removed from their own list. Out-of-context favorites are not treated as orphans.

**Operation ID:** `GET_api_favorites_user`

## Authorization

Requires: Favorites.Manage, merchant scope.

Required permissions:
- `Favorites.Manage`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| IncludeAllContexts | query | no | boolean | When true, the response also populates WinkPG.Favorites.UserFavoritePageDto.OutOfContext  with favorites stored under a different operating context. |
| EntityType | query | no | string | Optional entity-type filter. When set, only favorites of this entity type are returned. |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Responses

### 200

OK

**Content type:** `text/plain`

Schema: `WinkPGFavoritesUserFavoritePageDto`

**Content type:** `application/json`

Schema: `WinkPGFavoritesUserFavoritePageDto`

**Content type:** `text/json`

Schema: `WinkPGFavoritesUserFavoritePageDto`

### 403

Forbidden

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 401

Unauthorized

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 400

Bad Request

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 404

Not Found

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 501

Not Implemented

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 500

Internal Server Error

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

## See also

- [All documentation](https://docs.winkpg.io/llms.txt): the machine-readable index of every public page on this site.