Admit a ticket at the door
- Credentials, one of
- Station token
- OAuth access token
- Scopes
orders:write- Idempotency
- Send an
Idempotency-Keyheader. A retry with the same key does the work once.
Deliberately NOT write-gated: a lapsed plan must never stop a merchant opening their doors.
Access: OAuth scope orders:write; not write-gated.
AuthorizationBearer <token>It may call only the operations whose x-stations lists its kind, on its own store, and acts through the access of the owner or admin who paired it. Unpairing it, or that person leaving the business, ends it (401 station_revoked).
storeId*stringA store the person can reach. Any other id answers 404, never 403.
Idempotency-Key*stringRequired on every write. Minted on the device when the person taps, reused on every retry. A write without one, or with one that does not match the pattern, is refused with 422 validation_error. Scoped to the token's subject, remembered 24 hours. A replay returns the first 2xx response with Idempotent-Replay: true; a request still running answers 409 in_flight; the same key with a different method, path or body answers 409 idempotency_key_reused; non-2xx results are not remembered. If the key store cannot be read nothing is processed and the answer is 503 idempotency_unavailable: retry with the same key.
^[A-Za-z0-9_-]{8,128}$application/json- body
code*string1 <= lengthOK
application/json- response
data*A refused ticket is still a 200 with ok:false and a reason.
curl -X POST 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/tickets/scan' \ -H 'Authorization: Bearer <access_token>' \ -H 'Idempotency-Key: <unique_key>' \ -H 'Content-Type: application/json' \ -d '{ "code": "string"}'{ "data": { "ok": true, "reason": "unreadable", "code": "string", "eventTitle": "string", "ticketType": "string", "orderNumber": "string", "customerName": "string", "attendeeName": "string", "attendeeDetails": [ { "label": "string", "value": "string" } ], "redeemedAt": 0, "redeemedBy": "string" }}Tickets issued and admitted for an event GET
Access: OAuth scope `orders:read`; not write-gated.
The QR code for one ticket GET
A picture of the ticket code, for a ticket screen, a print or an email. `image/png`, 480 px with a quiet zone, or `image/svg+xml` with `format=svg` (what the console's order page draws). The body is the image, not the usual `{ data }` envelope; errors are the usual JSON. The code is the one on the issued ticket (`C1234567` style, case and spacing ignored); anything that is not code-shaped, or a code this store did not issue, is 404 `not_found`, so this can never draw an arbitrary string. It admits nobody on its own: the door still checks the code against the order with `scanTicket`. Access: OAuth scope `orders:read`; not write-gated.