Developers
V1Scan linksValidate

Booth scanner: check a member voucher

Uses the same validation and redemption code as signed-in booth staff (stock, uses per member, collect-by, duplicate protection) plus a wrong-merchant and wrong-outlet check. Returns only the offer title, its validity and a status: never a member name, contact, health data or points. Limited per unlocked device, so a shared venue IP cannot lock anyone out.

POST
/v1/scan-links/validate

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/scan-links/validate" \  -H "Content-Type: application/json" \  -d '{    "qrToken": "string"  }'
{  "status": "ready",  "offer": {    "title": "string",    "voucherExpiresAt": "2019-08-24T14:15:22Z",    "redeemedAt": "2019-08-24T14:15:22Z"  }}

Booth scanner: enter the six digit PIN once to unlock this device POST

Wrong PINs only ever pause new unlocks of this one link (10 per 15 minutes, a hard lock after 50 in a day until an owner or admin rotates the PIN). Devices that are already unlocked keep working, and the venue's shared IP address is never what locks anyone out. Returns a device secret that the web app keeps in an httpOnly cookie.

What the social surface offers right now GET

Public and read-only. Clients show only what is switched on: club posts and activity cards, member club creation (always off: clubs are created by staff), profile photos, and the version of the Community Rules in force.