The QR code for one ticket
- Credentials
- OAuth access token
- Scopes
orders:read
A picture of the ticket code, for a ticket screen, a print or an email. image/png, 480 px with a quiet zone, or image/svg+xml with format=svg (what the console's order page draws). The body is the image, not the usual { data } envelope; errors are the usual JSON.
The code is the one on the issued ticket (C1234567 style, case and spacing ignored); anything that is not code-shaped, or a code this store did not issue, is 404 not_found, so this can never draw an arbitrary string. It admits nobody on its own: the door still checks the code against the order with scanTicket.
Access: OAuth scope orders:read; not write-gated.
merchantOAuth orders:readAuthorizationBearer <token>OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.
Scope: orders:read
storeId*stringA store the person can reach. Any other id answers 404, never 403.
code*stringThe code printed on an issued ticket. Case and spacing are ignored.
format?stringImage format. Default png.
"png""png""svg"OK
response?filebinarycurl -X GET 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/tickets/<code>/qr' \ -H 'Authorization: Bearer <access_token>'"string"Admit a ticket at the door POST
Deliberately NOT write-gated: a lapsed plan must never stop a merchant opening their doors. Access: OAuth scope `orders:write`; not write-gated.
One ticket as a printable PDF GET
`application/pdf`: the store, the event's title, date, time and venue, the order number, the customer and the ticket with its QR. The body is the file, not the usual `{ data }` envelope; errors are the usual JSON. The PDF carries the event's date and venue as they are now, so it is cacheable for only five minutes. A code this store did not issue is 404 `not_found`. It admits nobody on its own: the door still checks the code against the order. Access: OAuth scope `orders:read`; not write-gated.