Developers
V1PartnerTenantsTenantidScan linksIdRotate

Merchant owner: rotate a scan link's token, PIN or both

Signs out every promoter device of the link. Rotating the PIN also lifts a PIN lockout. The new secrets are shown once.

POST
/v1/partner/tenants/{tenantId}/scan-links/{id}/rotate

Authorization

bearer
AuthorizationBearer <token>

In: header

Path Parameters

tenantId*string
Match^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
Formatuuid
id*string
Match^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/partner/tenants/497f6eca-6276-4993-bfeb-53cbbbba6f08/scan-links/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate" \  -H "Content-Type: application/json" \  -d '{    "secret": "link"  }'
{  "link": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "label": "string",    "outletId": "414ee52f-b8bb-444c-8e1a-824bf463e887",    "outletName": "string",    "status": "active",    "expiresAt": "2019-08-24T14:15:22Z",    "createdAt": "2019-08-24T14:15:22Z",    "rotatedAt": "2019-08-24T14:15:22Z",    "revokedAt": "2019-08-24T14:15:22Z",    "activeDevices": 0,    "lastUsedAt": "2019-08-24T14:15:22Z"  },  "token": "string",  "pin": "string"}

Merchant owner: revoke a scan link POST

Permanent and immediate: the link and every device that unlocked it stop working.

Read corporate workspace settings GET

Active corporate owners and HR admins may read settings with a fresh passkey session. Only owners may edit the company and contact display names. Email, login identity, membership roles and invitation recipients cannot be changed here. Changes use the shared corporate profile version and database audit triggers.