# POST /api/favorites/user

Pin an entity as a favorite for the operating user.

Idempotent for a given `(operating user, entityType, entityId)`: pinning something already pinned, or
re-pinning an entity the user previously removed, returns the existing (or restored and refreshed) favorite
instead of creating a duplicate. `entityType` must be a lowercase slug and `route` must be a local
app-relative path (absolute URLs and path traversal are rejected). Each user has a maximum number of favorites;
exceeding the cap is rejected rather than silently evicting the oldest.

**Operation ID:** `POST_api_favorites_user`

## Authorization

Requires: Favorites.Manage, merchant scope.

Required permissions:
- `Favorites.Manage`

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| suppressNulls | query | no | boolean | If true, omit properties with null values. |

## Request Body

The entity to pin: `entityType`, `entityId`, `scope`, display `label`, optional `subtitle`, and navigation `route`.

**Content type:** `application/json`

Schema: `WinkPGFavoritesAddFavoriteInput`

**Content type:** `text/json`

Schema: `WinkPGFavoritesAddFavoriteInput`

**Content type:** `application/*+json`

Schema: `WinkPGFavoritesAddFavoriteInput`

## Responses

### 200

OK

**Content type:** `text/plain`

Schema: `WinkPGFavoritesUserFavoriteDto`

**Content type:** `application/json`

Schema: `WinkPGFavoritesUserFavoriteDto`

**Content type:** `text/json`

Schema: `WinkPGFavoritesUserFavoriteDto`

### 403

Forbidden

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 401

Unauthorized

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 400

Bad Request

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 404

Not Found

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 501

Not Implemented

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### 500

Internal Server Error

**Content type:** `text/plain`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

**Content type:** `text/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

### default

The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. See the error-code reference in this document's description for the values `error.code` can take.

**Content type:** `application/json`

Schema: `WinkPGHttpRemoteServiceErrorResponse`

## See also

- [All documentation](https://docs.winkpg.io/llms.txt): the machine-readable index of every public page on this site.