Passpam API documentation v1

Passpam’s REST API v1 lets your apps, partner sites and business tools read and create events, orders and tickets, scan entries and receive webhooks — without ever bypassing platform rules (inventory, pricing, payments).

GET https://passpam.com/api/v1/public/events?category=music&per_page=20

Base URL: https://passpam.com/api/v1. The OpenAPI 3.1 specification is generated from the code and always up to date: openapi.json.

Authentication

API keys (server to server)

Created in Organizer › Integrations. Send the key in the Authorization header (Bearer). It is shown only once.

curl https://passpam.com/api/v1/events \
  -H "Authorization: Bearer pp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Each key carries scopes (events:read, orders:write…): a route requires the listed scope, otherwise 403 insufficient_scope.
A key is bound to one organization (or one reseller account): any resource of another organization returns 404.
A pp_test_… key is read-only on live data (403 test_mode_read_only on any write).
Rotation: the new key is active immediately, the old one expires after the transition period (24h by default). Revocation: immediate.

User tokens (Passpam app)

For the official app: POST /auth/login returns an access token (1h) and a refresh token (30d, single use — each refresh returns a new one). /me/* routes and organization routes are available according to the member’s permissions.

POST /api/v1/auth/login
{"email": "…", "password": "…", "device": {"platform": "android", "name": "Pixel 8"}}

→ {"success": true, "data": {"access_token": "pat_…", "refresh_token": "prt_…", "expires_in": 3600, …}}

Conventions

Response envelope

{"success": true,  "data": { … }, "meta": { … }}
{"success": false, "error": {"code": "validation_error", "message": "…", "details": {"email": "…"}}, "meta": {"request_id": "…"}}

Pagination, filters and sorting

Every collection is paginated (page, per_page ≤ 100). Filters are explicit (status, event_id, created_after…). Sorting only accepts the listed fields (sort, direction); any other field returns 422.

GET /api/v1/orders?status=confirmed&event_id=…&sort=created_at&direction=desc&page=2&per_page=50
"meta": {"pagination": {"current_page": 2, "per_page": 50, "total": 1234, "last_page": 25, "next": "/api/v1/orders?page=3&…", "previous": "/api/v1/orders?page=1&…"}}

Formats

Identifiers: public UUIDs only (never an internal numeric id).
Dates: ISO 8601 with the event time zone, or UTC (Z suffix): 2027-03-20T19:00:00-04:00
Amounts: decimal string + currency, never a float: {"amount": "5000.00", "currency": "HTG"}
Request bodies: application/json only (415 otherwise), 1 MB max.

Idempotency

On POST / PATCH / DELETE, send Idempotency-Key (8-190 chars). The same request within 24h returns the same response (Idempotent-Replayed: true header); the same key with a different body returns 409 idempotency_key_reused. Essential for order creation.

POST /api/v1/orders
Idempotency-Key: order-2027-000123
Content-Type: application/json

Rate limits

Per key (or per IP for the public API) and per route group: public (300/min), reads (600/min), writes (120/min), sensitive — payment, refund, cancel — (30/min), authentication (20/min). Beyond that: 429 rate_limit_exceeded with Retry-After.

X-RateLimit-Limit: 600
X-RateLimit-Remaining: 597
X-RateLimit-Reset: 1790452740
Retry-After: 12          (429 rate_limit_exceeded)

Versioning and deprecation

The path carries the version (/api/v1). A breaking change will ship as v2; v1 will stay available with a transition period announced through the Deprecation and Sunset headers and in the changelog. Error codes are stable; messages may be localized (Accept-Language).

Error codes

Base your integration on error.code, never on the message.

error.code	HTTP
`validation_error`	422
`invalid_credentials`	401
`mfa_required`	401
`unauthenticated`	401
`token_expired`	401
`token_revoked`	401
`invalid_api_key`	401
`api_key_revoked`	401
`api_key_expired`	401
`ip_not_allowed`	403
`insufficient_scope`	403
`permission_denied`	403
`test_mode_read_only`	403
`resource_not_found`	404
`method_not_allowed`	405
`conflict`	409
`idempotency_key_reused`	409
`idempotency_in_progress`	409
`invalid_state`	409
`inventory_unavailable`	409
`ticket_already_used`	409
`payment_required`	402
`rate_limit_exceeded`	429
`unsupported_media_type`	415
`payload_too_large`	413
`bad_request`	400
`organization_suspended`	403
`event_unavailable`	409
`internal_error`	500
`not_implemented`	501
`device_not_authorized`	403
`wallet_not_configured`	501
`update_required`	426
`maintenance`	503
`service_unavailable`	503
`checkout_expired`	410
`account_unverified`	403
`ticket_not_active`	409
`ticket_other_device`	409
`ticket_not_bound`	409

Public

GET /public/events Événements publiés (paginés, filtrables)

No authentication. · rate group: public

Query parameters

category string — slug de catégorie
city string
organization string — slug organisateur
event_type string — physical | online | hybrid
q string — recherche texte
starts_after datetime
starts_before datetime
coming_soon boolean — 1 = seulement les « Bientôt » (FEAT-053)
sort string — starts_at | published_at | title
direction string — asc | desc
page integer
per_page integer — max 100

curl -X GET https://passpam.com/api/v1/public/events

GET /public/events/{slug} Détail d’un événement publié (par slug ou uuid) avec types de billets et disponibilités ; features (follow, waitlist, addons) ; waitlist par billet complet

No authentication. · rate group: public

Query parameters

include_addons boolean — 1 = inclure les articles en plus (is_addon) — applis 2.3+

curl -X GET https://passpam.com/api/v1/public/events/…

GET /public/events/{slug}/seats Plan de salle (FEAT-057, applis 2.4) : blocs, rangées, places libres ; choix retenu par POST /checkout (seats)

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/public/events/…/seats

POST /public/events/{slug}/waitlist Liste d’attente d’un billet complet (FEAT-054) — même réponse qu’une adresse soit nouvelle ou déjà inscrite

No authentication. · rate group: public

Body (JSON)

ticket_type_id string required — uuid
email string required
phone string
name string
quantity integer
language string — fr | en | ht

curl -X POST https://passpam.com/api/v1/public/events/…/waitlist \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /public/events/{slug}/alert Être prévenu(e) à l’ouverture de la billetterie (événement « Bientôt ») — une seule alerte, coordonnées gardées par Passpam

No authentication. · rate group: public

Body (JSON)

email string — courriel (ou phone)
phone string — numéro pour un SMS (facultatif)
language string — fr | en | ht

curl -X POST https://passpam.com/api/v1/public/events/…/alert \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /public/artists Artistes publiés (FEAT-061) — recherche et filtre par genre, paginés

No authentication. · rate group: public

Query parameters

q string — nom
genre string — clé du genre (ex. kompa)
page integer
per_page integer — max 100

curl -X GET https://passpam.com/api/v1/public/artists

GET /public/artists/{slug} Profil d’un artiste : photo, bio, genres, réseaux, événements à venir et passés, follow {available, followers}

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/public/artists/…

POST /public/tickets/lookup/start Retrouver mes billets (sans compte) : envoie un code à 6 chiffres SI des billets correspondent — réponse toujours identique (lookup_id, channel, masked, expires_in)

No authentication. · rate group: sensitive

Body (JSON)

contact string required — e-mail ou numéro (WhatsApp)
language string — fr | en | ht

curl -X POST https://passpam.com/api/v1/public/tickets/lookup/start \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /public/tickets/lookup/verify Vérifie le code (5 essais, 10 min) → billets avec leur lien sécurisé (ticket_url, null pour un billet donné), accès 30 min ; 422 invalid_code / code_expired / code_locked

No authentication. · rate group: sensitive

Body (JSON)

lookup_id string required
code string required

curl -X POST https://passpam.com/api/v1/public/tickets/lookup/verify \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /public/categories Catégories d’événements

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/public/categories

GET /public/partners Partenaires affichés (nom, logo_url, website_url) — liste vide si aucun

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/public/partners

Cashless

GET /cashless/ping Caisse reliée : événement, devises, plafonds hors ligne (en-tête X-Cashless-Key)

No authentication. · rate group: cashless

curl -X GET https://passpam.com/api/v1/cashless/ping

POST /cashless/identify Billet ou bracelet scanné : prénom, type, soldes (offert / payé) par devise

No authentication. · rate group: cashless

Body (JSON)

code string required — contenu du QR du billet ou du bracelet

curl -X POST https://passpam.com/api/v1/cashless/identify \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /cashless/charge Dépense (crédit offert d’abord) — idempotente par référence

No authentication. · rate group: cashless

Body (JSON)

code string required
amount number required
currency string required — HTG | USD
reference string required — identifiant unique de la vente dans la caisse
stand string

curl -X POST https://passpam.com/api/v1/cashless/charge \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /cashless/topup Recharge en espèces encaissée par l’organisateur — idempotente

No authentication. · rate group: cashless

Body (JSON)

code string required
amount number required
currency string required — HTG | USD
reference string required

curl -X POST https://passpam.com/api/v1/cashless/topup \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /cashless/refund Annule une dépense (rend offert et payé)

No authentication. · rate group: cashless

Body (JSON)

charge_reference string required
reference string required

curl -X POST https://passpam.com/api/v1/cashless/refund \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /cashless/offline-pack Paquet hors ligne : empreintes des codes, soldes, plafonds

No authentication. · rate group: cashless

curl -X GET https://passpam.com/api/v1/cashless/offline-pack

POST /cashless/sync Envoie les opérations faites hors ligne (jusqu’à 500)

No authentication. · rate group: cashless

Body (JSON)

operations array required — [{reference, type: charge

curl -X POST https://passpam.com/api/v1/cashless/sync \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

Auth

POST /auth/login Connexion application : access token (1 h) + refresh token (30 j)

No authentication. · rate group: auth

Body (JSON)

email string required
password string required
device object — {platform: ios

curl -X POST https://passpam.com/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /auth/social FEAT-058 : connexion / inscription avec Google, Apple ou Facebook (jeton du SDK natif) → jetons, ou inscription à finaliser (signup_token)

No authentication. · rate group: auth

Body (JSON)

provider string required — google | apple | facebook
token string — id_token (Google, Apple) ou jeton d’accès (Facebook)
nonce string
signup_token string
first_name string
last_name string
phone string
country_code string
terms_accepted boolean
device object

curl -X POST https://passpam.com/api/v1/auth/social \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /auth/social/exchange Applis 2.4 : code passpam://auth/social?code=… (connexion Google / Facebook dans le navigateur du téléphone) → jetons

No authentication. · rate group: auth

Body (JSON)

code string required
device object

curl -X POST https://passpam.com/api/v1/auth/social/exchange \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /auth/refresh Renouvelle la paire de jetons (refresh token à usage unique)

No authentication. · rate group: auth

Body (JSON)

refresh_token string required

curl -X POST https://passpam.com/api/v1/auth/refresh \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /auth/logout Déconnexion de l’appareil courant

User token only. · rate group: auth

curl -X POST https://passpam.com/api/v1/auth/logout \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /auth/sessions Appareils connectés

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/auth/sessions \
  -H "Authorization: Bearer "

DELETE /auth/sessions/{uuid} Révoque un appareil

User token only. · rate group: auth

curl -X DELETE https://passpam.com/api/v1/auth/sessions/… \
  -H "Authorization: Bearer "

Me

GET /me Profil de l’utilisateur du jeton

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me \
  -H "Authorization: Bearer "

PATCH /me Met à jour le profil

User token only. · rate group: write

Body (JSON)

first_name string
last_name string
phone string
country_code string — ISO 3166-1 alpha-2 (HT, US…)
birth_date string — AAAA-MM-JJ (13 ans minimum)
gender string — female | male | other | undisclosed
city string
address_line string
preferred_language string — fr | ht | en
timezone string

curl -X PATCH https://passpam.com/api/v1/me \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/tickets Mes billets (chaque billet : protection FEAT-059 ou null ; la liste ne lie jamais d’appareil)

User token only. · rate group: default

Query parameters

scope string — upcoming | past | all
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/me/tickets \
  -H "Authorization: Bearer "

GET /me/tickets/{uuid} Un billet avec son QR (billet valide, événement à venir) ; FEAT-059 protection {state: pending|active|other_device|over, activates_at, bound_here, transfer_locked, screenshot_protection, message} ou null — billet protégé : qr = QR animé (PPD1, 30 s) seulement s’il est actif et lié à cet appareil (lié à l’affichage), sinon null

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/tickets/… \
  -H "Authorization: Bearer "

GET /me/tickets/{uuid}/dynamic-qr QR dynamique courant (payload signé, svg, expires_at, ttl) — 404 dynamic_qr_unavailable si non activé. FEAT-059 billet protégé : lie l’appareil au 1er appel une fois actif (ttl 30) ; 409 ticket_not_active (details.activates_at) / 409 ticket_other_device

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/tickets/…/dynamic-qr \
  -H "Authorization: Bearer "

GET /me/tickets/{uuid}/dynamic-qr/batch Billet protégé ACTIF et lié à cet appareil : {ttl:30, tokens:[{payload, valid_from, expires_at}]} de maintenant à maintenant + minutes (≤ prefetch_minutes) ; chaque jeton n’est accepté que dans sa fenêtre. 409 ticket_not_active / ticket_other_device / ticket_not_bound, 429 si trop de demandes ; no-store

User token only. · rate group: sensitive

Query parameters

minutes integer — 1 à prefetch_minutes (réglage Passpam, 120 par défaut)

curl -X GET https://passpam.com/api/v1/me/tickets/…/dynamic-qr/batch \
  -H "Authorization: Bearer "

POST /me/avatar Photo de profil (FEAT-032) — réencodée en WebP carré 400 px + miniature 96 px ; renvoie le profil

User token only. · rate group: sensitive

Body (JSON)

image_base64 string required — JPEG/PNG/WebP en base64 (≤ 5 Mo, ≥ 64 px), redimensionnée côté app

curl -X POST https://passpam.com/api/v1/me/avatar \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /me/avatar Retire la photo de profil ; renvoie le profil

User token only. · rate group: write

curl -X DELETE https://passpam.com/api/v1/me/avatar \
  -H "Authorization: Bearer "

POST /me/tickets/{uuid}/photo Photo du participant (si demandée par l’organisateur), modifiable jusqu’à la première entrée — image redimensionnée côté app (corps ≤ 1 Mo)

User token only. · rate group: sensitive

Body (JSON)

image_base64 string required — JPEG/PNG/WebP en base64, ≥ 120 px

curl -X POST https://passpam.com/api/v1/me/tickets/…/photo \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /me/tickets/{uuid}/holder Donne le billet à quelqu’un (nouveau QR envoyé, l’ancien ne passe plus) ou corrige le nom — fonction « Transfert de billet » et délai réglés par le super administrateur

User token only. · rate group: sensitive

Body (JSON)

first_name string required
last_name string required
email string — courriel (ou phone)
phone string
message string — 2.53.0 — mot pour le destinataire, ≤ 280 caractères, texte brut

curl -X POST https://passpam.com/api/v1/me/tickets/…/holder \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/tickets/{uuid}/live Événement en ligne : lien Zoom / Meet (type link) ou vidéo YouTube (type youtube), seulement pendant la fenêtre d’accès — 409 invalid_state sinon

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/tickets/…/live \
  -H "Authorization: Bearer "

GET /me/following Organisateurs suivis

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/following \
  -H "Authorization: Bearer "

GET /me/following/artists Artistes suivis (FEAT-061)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/following/artists \
  -H "Authorization: Bearer "

POST /me/following/artists Suivre / ne plus suivre un artiste (FEAT-061) — 403 si « Suivre » est désactivé

User token only. · rate group: write

Body (JSON)

artist string required — slug
follow boolean required

curl -X POST https://passpam.com/api/v1/me/following/artists \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /me/following Suivre / ne plus suivre un organisateur

User token only. · rate group: write

Body (JSON)

organization string required — slug
follow boolean required

curl -X POST https://passpam.com/api/v1/me/following \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/orders Mes commandes

User token only. · rate group: default

Query parameters

status string
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/me/orders \
  -H "Authorization: Bearer "

POST /me/orders/{uuid}/give Donne plusieurs billets de SA commande (≤ 20) avec un message commun facultatif ; résultat billet par billet {ticket_id, transferred, recipient_has_account, error}

User token only. · rate group: sensitive

Body (JSON)

items array required — [{ticket_id, first_name, last_name, email?, phone?}]
message string — ≤ 280 caractères, texte brut

curl -X POST https://passpam.com/api/v1/me/orders/…/give \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/orders/{uuid} Une commande (lignes, billets, paiements)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/orders/… \
  -H "Authorization: Bearer "

GET /me/notifications Notifications in-app

User token only. · rate group: default

Query parameters

unread string — 0 | 1
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/me/notifications \
  -H "Authorization: Bearer "

POST /me/notifications/{uuid}/read Marque une notification lue (uuid ou « all »)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/me/notifications/…/read \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/favorites Événements favoris

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/favorites \
  -H "Authorization: Bearer "

POST /me/favorites/toggle Ajoute / retire un favori

User token only. · rate group: write

Body (JSON)

event_id string required — uuid

curl -X POST https://passpam.com/api/v1/me/favorites/toggle \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

Mobile

GET /app/config Configuration des applications : versions minimale / recommandée, maintenance, fonctionnalités, liens

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/app/config

POST /auth/register Création de compte depuis l’application (même politique que le site) + jetons

No authentication. · rate group: auth

Body (JSON)

first_name string required
last_name string required
email string required
phone string
password string required
language string — fr | ht | en
terms_accepted boolean required
device object — {platform, name, install_id, app_version}

curl -X POST https://passpam.com/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /auth/password/forgot Lien de réinitialisation par e-mail (réponse identique que le compte existe ou non)

No authentication. · rate group: auth

Body (JSON)

email string required

curl -X POST https://passpam.com/api/v1/auth/password/forgot \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /me/email/verify/resend Renvoie l’e-mail de vérification

User token only. · rate group: auth

curl -X POST https://passpam.com/api/v1/me/email/verify/resend \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/contexts Contextes autorisés : Personnel, Organisateur, Revendeur, Scanner (meta.current)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/contexts \
  -H "Authorization: Bearer "

POST /me/context Change de contexte (revalidé par le serveur)

User token only. · rate group: write

Body (JSON)

id string required — ex. organizer:<uuid>

curl -X POST https://passpam.com/api/v1/me/context \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/devices Mes appareils (sessions de l’application, état du push)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/devices \
  -H "Authorization: Bearer "

POST /me/delete-account Supprime (anonymise) le compte — mot de passe et confirmation « DELETE »

User token only. · rate group: sensitive

Body (JSON)

password string required
confirm string required — DELETE

curl -X POST https://passpam.com/api/v1/me/delete-account \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /me/tickets/{uuid}/wallet/{kind} FEAT-029 : pass Apple Wallet (pkpass_base64, pour PassKit) ou lien Google Wallet (save_url) — 501 wallet_not_configured si non activé, 409 wallet_unavailable si le billet n’est pas éligible

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/me/tickets/…/wallet/… \
  -H "Authorization: Bearer "

GET /me/tickets/{uuid}/share-card/{format} FEAT-048 : carte « J’y serai ! / J’y suis ! / J’y étais ! » (story ou square) en JPEG base64 + textes de partage — sans QR ni numéro de billet ; 409 share_unavailable si le billet ne s’y prête pas

User token only. · rate group: default

Query parameters

n string — 0 | 1
p string — 0 | 1
b string — 0 | 1
l string — fr | ht | en

curl -X GET https://passpam.com/api/v1/me/tickets/…/share-card/… \
  -H "Authorization: Bearer "

POST /devices/push-token Enregistre le jeton push APNs / FCM de l’appareil

User token only. · rate group: write

Body (JSON)

platform string required — ios | android
token string required
device_id string required — identifiant d’installation
app_version string
environment string — production | sandbox
locale string — fr | ht | en
device_name string

curl -X POST https://passpam.com/api/v1/devices/push-token \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /devices/push-token Désactive le push de l’appareil

User token only. · rate group: write

Body (JSON)

token string
device_id string

curl -X DELETE https://passpam.com/api/v1/devices/push-token \
  -H "Authorization: Bearer "

GET /organizer/summary Tableau de bord Organisateur mobile (événements à venir, ventes du jour selon permissions)

User token only. · rate group: default

Query parameters

organization_id string — uuid

curl -X GET https://passpam.com/api/v1/organizer/summary \
  -H "Authorization: Bearer "

Organizer app

GET /organizer/form-options Catégories, devises, fuseaux, pays, moyens de versement (libellés traduits)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/form-options \
  -H "Authorization: Bearer "

GET /organizer/organizations Mes organisations et mes permissions

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/organizations \
  -H "Authorization: Bearer "

POST /organizer/organizations Crée une organisation (vous en devenez propriétaire)

User token only. · rate group: sensitive

Body (JSON)

name string required
country_code string
default_currency string — HTG | USD
timezone string
email string
phone string
description string

curl -X POST https://passpam.com/api/v1/organizer/organizations \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /organizer/organizations/{uuid} Profil de l’organisation

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/organizations/… \
  -H "Authorization: Bearer "

PATCH /organizer/organizations/{uuid} Modifie le profil (champs envoyés seulement)

User token only. · permission organization.edit · rate group: write

curl -X PATCH https://passpam.com/api/v1/organizer/organizations/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /organizer/organizations/{uuid}/logo Logo (image_base64, 200 × 200 minimum)

User token only. · permission organization.edit · rate group: sensitive

curl -X POST https://passpam.com/api/v1/organizer/organizations/…/logo \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /organizer/organizations/{uuid}/logo Retire le logo

User token only. · permission organization.edit · rate group: write

curl -X DELETE https://passpam.com/api/v1/organizer/organizations/…/logo \
  -H "Authorization: Bearer "

GET /organizer/organizations/{uuid}/events Événements de l’organisation

User token only. · permission event.view · rate group: default

Query parameters

status string — upcoming | draft | past

curl -X GET https://passpam.com/api/v1/organizer/organizations/…/events \
  -H "Authorization: Bearer "

POST /organizer/organizations/{uuid}/events Crée un brouillon (dates en heure locale ; premier billet facultatif)

User token only. · permission event.create · rate group: write

curl -X POST https://passpam.com/api/v1/organizer/organizations/…/events \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /organizer/organizations/{uuid}/team Équipe : membres, invitations, rôles

User token only. · permission team.manage · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/organizations/…/team \
  -H "Authorization: Bearer "

POST /organizer/organizations/{uuid}/team/invitations Invite un membre par e-mail

User token only. · permission team.manage · rate group: sensitive

Body (JSON)

email string required
role_id int required

curl -X POST https://passpam.com/api/v1/organizer/organizations/…/team/invitations \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /organizer/organizations/{uuid}/team/invitations/{id} Annule une invitation

User token only. · permission team.manage · rate group: write

curl -X DELETE https://passpam.com/api/v1/organizer/organizations/…/team/invitations/… \
  -H "Authorization: Bearer "

PATCH /organizer/organizations/{uuid}/team/members/{id} Change le rôle ou le statut d’un membre

User token only. · permission team.manage · rate group: write

curl -X PATCH https://passpam.com/api/v1/organizer/organizations/…/team/members/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /organizer/organizations/{uuid}/payout-methods Moyens de versement (résumés masqués)

User token only. · permission finance.view · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/organizations/…/payout-methods \
  -H "Authorization: Bearer "

POST /organizer/organizations/{uuid}/payout-methods Ajoute / modifie un moyen de versement (mot de passe exigé)

User token only. · permission finance.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/organizer/organizations/…/payout-methods \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /organizer/organizations/{uuid}/payout-methods/{id}/{action} default | disable (mot de passe exigé)

User token only. · permission finance.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/organizer/organizations/…/payout-methods/…/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /organizer/events/{uuid} Fiche complète : billets, liste « pour publier », chiffres, actions possibles

User token only. · permission event.view · rate group: default

curl -X GET https://passpam.com/api/v1/organizer/events/… \
  -H "Authorization: Bearer "

PATCH /organizer/events/{uuid} Modifie un événement (champs envoyés seulement)

User token only. · permission event.edit · rate group: write

curl -X PATCH https://passpam.com/api/v1/organizer/events/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /organizer/events/{uuid} Supprime un brouillon jamais publié

User token only. · permission event.delete · rate group: write

curl -X DELETE https://passpam.com/api/v1/organizer/events/… \
  -H "Authorization: Bearer "

POST /organizer/events/{uuid}/poster Affiche (image_base64)

User token only. · permission event.edit · rate group: sensitive

curl -X POST https://passpam.com/api/v1/organizer/events/…/poster \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /organizer/events/{uuid}/ticket-types Ajoute un billet

User token only. · permission ticket.create · rate group: write

Body (JSON)

name string required
kind string — paid | free
price string
quantity int required

curl -X POST https://passpam.com/api/v1/organizer/events/…/ticket-types \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /organizer/events/{uuid}/{action} publish | unpublish | cancel {reason} | duplicate

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/organizer/events/…/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

PATCH /organizer/ticket-types/{uuid} Modifie un billet (nom, prix, quantité…)

User token only. · permission ticket.edit · rate group: write

curl -X PATCH https://passpam.com/api/v1/organizer/ticket-types/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /organizer/ticket-types/{uuid}/{action} pause | resume

User token only. · permission ticket.pause · rate group: write

curl -X POST https://passpam.com/api/v1/organizer/ticket-types/…/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

Checkout

POST /checkout Remplace le panier et réserve le stock ; plan de salle : seats = identifiants des places choisies

No authentication. · rate group: write

Body (JSON)

items array — [{ticket_type_id, quantity}]
seats array — [seat_id…] (GET /public/events/{slug}/seats)
event_id string — uuid de l’événement (obligatoire avec seats)

curl -X POST https://passpam.com/api/v1/checkout \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /checkout/{uuid} Panier : lignes, pricing serveur (fee_lines : frais de service / de traitement), temps restant, moyens de paiement, formulaires participants ; ?provider=code → frais de traitement de ce moyen (2.54.0)

No authentication. · rate group: write

curl -X GET https://passpam.com/api/v1/checkout/…

POST /checkout/{uuid}/promo Applique un code promo

No authentication. · rate group: write

Body (JSON)

code string required

curl -X POST https://passpam.com/api/v1/checkout/…/promo \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /checkout/{uuid}/promo Retire le code promo

No authentication. · rate group: write

curl -X DELETE https://passpam.com/api/v1/checkout/…/promo

POST /checkout/{uuid}/complete Crée la commande (client, participants, conditions)

No authentication. · rate group: write

Body (JSON)

customer object required
attendees object — {item_id: [{first_name, last_name, email, answers}]}
terms_accepted boolean required
marketing_consent boolean
language string
provider string — moyen de paiement choisi (frais de traitement, 2.54.0)

curl -X POST https://passpam.com/api/v1/checkout/…/complete \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /checkout/orders/{uuid} Commande (état waiting / processing / confirmed / failed / cancelled)

No authentication. · rate group: write

curl -X GET https://passpam.com/api/v1/checkout/orders/…

POST /checkout/orders/{uuid}/pay Initie le paiement (PaymentService) — renvoie payment_url à ouvrir ; frais de traitement recalculés pour ce moyen (total et fee_lines à jour)

No authentication. · rate group: write

Body (JSON)

provider string required

curl -X POST https://passpam.com/api/v1/checkout/orders/…/pay \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /checkout/orders/{uuid}/status Interroge le fournisseur puis renvoie l’état réel du paiement

No authentication. · rate group: write

curl -X GET https://passpam.com/api/v1/checkout/orders/…/status

Scanner

GET /scanner/events Événements que je peux scanner (assignations)

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events \
  -H "Authorization: Bearer "

GET /scanner/events/{uuid}/context Contexte résolu : porte, zone, session, permissions, compteurs

User token only. · rate group: write

Query parameters

gate_id integer
access_zone_id integer
event_session_id integer

curl -X GET https://passpam.com/api/v1/scanner/events/…/context \
  -H "Authorization: Bearer "

POST /scanner/events/{uuid}/devices Enregistre cet appareil (clé renvoyée une seule fois)

User token only. · rate group: write

Body (JSON)

name string required
platform string — ios | android

curl -X POST https://passpam.com/api/v1/scanner/events/…/devices \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/validate Vérifie un billet sans l’enregistrer

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/scanner/events/…/validate \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/checkin Enregistre une entrée (scan_request_id = idempotence) ; refus = 200 success:false + result (2.53.2 : qr_replaced = ancien QR d’un billet donné / réattribué, not_a_ticket = QR de l’affiche de l’événement) — afficher message

User token only. · rate group: write

Body (JSON)

payload string
ticket_uuid string
scan_request_id string
gate_id integer
access_zone_id integer
event_session_id integer

curl -X POST https://passpam.com/api/v1/scanner/events/…/checkin \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/checkout Enregistre une sortie

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/scanner/events/…/checkout \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/override Entrée forcée (checkin.override, motif obligatoire)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/scanner/events/…/override \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/checkins/{checkin}/undo Annule un check-in (checkin.undo)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/scanner/events/…/checkins/…/undo \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /scanner/events/{uuid}/search Recherche manuelle (nom, numéro de billet)

User token only. · rate group: write

Query parameters

q string

curl -X GET https://passpam.com/api/v1/scanner/events/…/search \
  -H "Authorization: Bearer "

GET /scanner/events/{uuid}/tickets/{ticket} Statut d’un billet (+ historique selon permission)

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/tickets/… \
  -H "Authorization: Bearer "

GET /scanner/events/{uuid}/stats Statistiques de check-in en direct

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/stats \
  -H "Authorization: Bearer "

GET /scanner/events/{uuid}/tickets/{ticket}/access État IN / OUT, règles effectives, bracelet, frise des mouvements

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/tickets/…/access \
  -H "Authorization: Bearer "

GET /scanner/events/{uuid}/tickets/{ticket}/photo Photo du participant (checkin.photo.view, consultation journalisée)

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/tickets/…/photo \
  -H "Authorization: Bearer "

POST /scanner/events/{uuid}/tickets/{ticket}/actions Action superviseur : bloquer, débloquer, sortie forcée, corriger (motif obligatoire)

User token only. · rate group: write

Body (JSON)

action string required — block | unblock | force_exit | correct
reason string required
target_state string — not_checked_in | in | out

curl -X POST https://passpam.com/api/v1/scanner/events/…/tickets/…/actions \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /scanner/events/{uuid}/tickets/{ticket}/wristband Remplacement du bracelet (checkin.wristband.replace, motif obligatoire)

User token only. · rate group: write

Body (JSON)

code string required
reason string required

curl -X POST https://passpam.com/api/v1/scanner/events/…/tickets/…/wristband \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /scanner/events/{uuid}/offline-package Paquet hors ligne (empreintes des billets, jamais de jeton) — mode hors ligne activé + checkin.offline + appareil enregistré

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/offline-package \
  -H "Authorization: Bearer "

POST /scanner/events/{uuid}/offline-sync Synchronise les scans hors ligne (idempotent par identifiant de scan ; conflits enregistrés, jamais écrasés)

User token only. · rate group: write

Body (JSON)

batch_id string required — uuid
items array required — 500 scans maximum

curl -X POST https://passpam.com/api/v1/scanner/events/…/offline-sync \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /scanner/events/{uuid}/access/live Comptage réel : à l’intérieur, sortis, réentrées, bloqués, capacité

User token only. · rate group: write

curl -X GET https://passpam.com/api/v1/scanner/events/…/access/live \
  -H "Authorization: Bearer "

Reseller POS

GET /reseller/accounts Mes comptes revendeurs, rôles, permissions, points de vente

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/accounts \
  -H "Authorization: Bearer "

GET /reseller/context Contexte POS (compte + point de vente)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/context \
  -H "Authorization: Bearer "

GET /reseller/dashboard Tableau de bord revendeur (selon permissions financières)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/dashboard \
  -H "Authorization: Bearer "

GET /reseller/pos/events Événements autorisés au compte / point de vente

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/pos/events \
  -H "Authorization: Bearer "

GET /reseller/pos/events/{uuid} Types de billets vendables et stock

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/pos/events/… \
  -H "Authorization: Bearer "

POST /reseller/pos/calculate Calcul serveur du total (aperçu)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/reseller/pos/calculate \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /reseller/pos/sales Vente rapide atomique (idempotency_key obligatoire)

User token only. · rate group: sensitive

curl -X POST https://passpam.com/api/v1/reseller/pos/sales \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /reseller/pos/sales/status/{key} État d’une vente par sa clé d’idempotence

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/pos/sales/status/… \
  -H "Authorization: Bearer "

GET /reseller/pos/customers/lookup Client existant par téléphone / e-mail

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/pos/customers/lookup \
  -H "Authorization: Bearer "

GET /reseller/stock Stock : alloué, reçu, transféré, vendu, réservé, disponible

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/stock \
  -H "Authorization: Bearer "

GET /reseller/stock/destinations Destinations de transfert autorisées

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/stock/destinations \
  -H "Authorization: Bearer "

POST /reseller/stock/transfer Transfert de stock (confirm: true obligatoire)

User token only. · rate group: sensitive

curl -X POST https://passpam.com/api/v1/reseller/stock/transfer \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /reseller/sales Historique des ventes (filtres période, recherche)

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/sales \
  -H "Authorization: Bearer "

GET /reseller/sales/{uuid} Détail d’une vente

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/sales/… \
  -H "Authorization: Bearer "

POST /reseller/sales/{uuid}/cancel Annule une vente (reseller.sale.cancel)

User token only. · rate group: sensitive

curl -X POST https://passpam.com/api/v1/reseller/sales/…/cancel \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /reseller/sales/{uuid}/send Renvoie les billets (email / sms / whatsapp)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/reseller/sales/…/send \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /reseller/sales/{uuid}/receipt Reçu de vente

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/sales/…/receipt \
  -H "Authorization: Bearer "

GET /reseller/cash-register Sessions de caisse

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/cash-register \
  -H "Authorization: Bearer "

GET /reseller/cash-register/current Caisse ouverte du point de vente

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/cash-register/current \
  -H "Authorization: Bearer "

POST /reseller/cash-register/open Ouvre la caisse (fond de caisse)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/reseller/cash-register/open \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /reseller/cash-register/{uuid}/close Ferme la caisse (espèces comptées, écart)

User token only. · rate group: write

curl -X POST https://passpam.com/api/v1/reseller/cash-register/…/close \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /reseller/cash-register/{uuid} Une session de caisse

User token only. · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/cash-register/… \
  -H "Authorization: Bearer "

Events

GET /events Événements de l’organisation

Organization key or member user token. · scope events:read · permission event.view · rate group: default

Query parameters

status string — draft | pending_review | published | cancelled | completed | archived
event_type string
visibility string
category string
q string
starts_after datetime
starts_before datetime
updated_since datetime
sort string — starts_at | created_at | updated_at | title
direction string — asc | desc
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/events \
  -H "Authorization: Bearer "

POST /events Crée un événement (brouillon)

Organization key or member user token. · scope events:write · permission event.create · rate group: write

Body (JSON)

title string required
category_id integer required
event_type string required — physical | online | hybrid
timezone string required
starts_at string required — heure locale AAAA-MM-JJ HH:MM:SS
ends_at string
short_description string
description string — HTML nettoyé
visibility string — public | private | unlisted
currency string
capacity integer
venue_id integer
new_venue object
tags array
organization_id string — uuid — jeton utilisateur uniquement

curl -X POST https://passpam.com/api/v1/events \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /events/{uuid} Détail d’un événement avec ses types de billets

Organization key or member user token. · scope events:read · permission event.view · rate group: default

curl -X GET https://passpam.com/api/v1/events/… \
  -H "Authorization: Bearer "

PATCH /events/{uuid} Modifie un événement (changement matériel → notifications aux acheteurs)

Organization key or member user token. · scope events:write · permission event.edit · rate group: write

Body (JSON)

title string
starts_at string
ends_at string
timezone string
venue_id integer
description string
short_description string
visibility string
capacity integer

curl -X PATCH https://passpam.com/api/v1/events/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /events/{uuid}/publish Publie (ou soumet à modération)

Organization key or member user token. · scope events:write · permission event.publish · rate group: write

curl -X POST https://passpam.com/api/v1/events/…/publish \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /events/{uuid}/cancel Annule un événement (acheteurs notifiés par lots)

Organization key or member user token. · scope events:write · permission event.edit · rate group: sensitive

Body (JSON)

reason string required

curl -X POST https://passpam.com/api/v1/events/…/cancel \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /events/{uuid}/ticket-types Types de billets d’un événement

Organization key or member user token. · scope events:read · permission ticket.view · rate group: default

curl -X GET https://passpam.com/api/v1/events/…/ticket-types \
  -H "Authorization: Bearer "

POST /events/{uuid}/ticket-types Crée un type de billet

Organization key or member user token. · scope events:write · permission ticket.create · rate group: write

Body (JSON)

name string required
price number required
quantity_total integer required
description string
min_per_order integer
max_per_order integer
sales_start_at string
sales_end_at string
visibility string — public | hidden | access_code
status string — active | paused | scheduled
session_id string — uuid de session

curl -X POST https://passpam.com/api/v1/events/…/ticket-types \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /events/{uuid}/availability Disponibilité de tous les types de billets d’un événement

Organization key or member user token. · scope inventory:read · permission inventory.view · rate group: default

curl -X GET https://passpam.com/api/v1/events/…/availability \
  -H "Authorization: Bearer "

GET /ticket-types/{uuid} Un type de billet

Organization key or member user token. · scope events:read · permission ticket.view · rate group: default

curl -X GET https://passpam.com/api/v1/ticket-types/… \
  -H "Authorization: Bearer "

PATCH /ticket-types/{uuid} Modifie un type de billet (prix, quantité, fenêtre de vente…)

Organization key or member user token. · scope events:write · permission ticket.edit · rate group: write

Body (JSON)

name string
price number
quantity_total integer
status string
visibility string
sales_start_at string
sales_end_at string
max_per_order integer

curl -X PATCH https://passpam.com/api/v1/ticket-types/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /ticket-types/{uuid}/availability Disponibilité : available, status, sales_start, sales_end

Organization key or member user token. · scope inventory:read · permission inventory.view · rate group: default

curl -X GET https://passpam.com/api/v1/ticket-types/…/availability \
  -H "Authorization: Bearer "

Orders

GET /orders Commandes (filtrables, paginées)

Organization key or member user token. · scope orders:read · permission order.view · rate group: default

Query parameters

status string — pending | confirmed | cancelled | expired | refunded | partially_refunded
payment_status string
sales_channel string — web | reseller | admin | api | complimentary
event_id string — uuid
email string
number string
created_after datetime
created_before datetime
updated_since datetime
sort string — created_at | updated_at | total | number
direction string
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/orders \
  -H "Authorization: Bearer "

POST /orders Crée une commande (canal api) — Idempotency-Key recommandée

Organization key or member user token. · scope orders:write · permission order.manage · rate group: sensitive

Body (JSON)

event_id string required — uuid
items array required — [{ticket_type_id, quantity}]
customer object required — {first_name, last_name, email, phone?}
language string — fr | ht | en
promo_code string

curl -X POST https://passpam.com/api/v1/orders \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /orders/{uuid} Une commande : lignes, billets, paiements (payments:read)

Organization key or member user token. · scope orders:read · permission order.view · rate group: default

curl -X GET https://passpam.com/api/v1/orders/… \
  -H "Authorization: Bearer "

POST /orders/{uuid}/cancel Annule une commande en attente

Organization key or member user token. · scope orders:write · permission order.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/orders/…/cancel \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /orders/{uuid}/payments Initie un paiement via un fournisseur autorisé (jamais « paid=true ») ; `manual` exige payments:record

Organization key or member user token. · scope payments:initiate · permission order.manage · rate group: sensitive

Body (JSON)

provider string required — code fournisseur (manual, mock_online…)
method string — cash, mobile_money, bank_transfer, other, online
reference string
return_url string

curl -X POST https://passpam.com/api/v1/orders/…/payments \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /orders/{uuid}/tickets Billets d’une commande (sans jeton sécurisé)

Organization key or member user token. · scope tickets:read · permission ticket.view · rate group: default

curl -X GET https://passpam.com/api/v1/orders/…/tickets \
  -H "Authorization: Bearer "

POST /orders/{uuid}/tickets/resend Renvoie les billets (email / sms / whatsapp) — 5 renvois par heure

Organization key or member user token. · scope tickets:issue · permission order.manage · rate group: sensitive

Body (JSON)

channel string — email | sms | whatsapp
recipient string

curl -X POST https://passpam.com/api/v1/orders/…/tickets/resend \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /tickets/{uuid} Un billet

Organization key or member user token. · scope tickets:read · permission ticket.view · rate group: default

curl -X GET https://passpam.com/api/v1/tickets/… \
  -H "Authorization: Bearer "

Attendees

GET /attendees Participants (données minimisées)

Organization key or member user token. · scope attendees:read · permission attendee.view · rate group: default

Query parameters

event_id string — uuid
status string
q string
checked_in string — 0 | 1
page integer
per_page integer — max 200

curl -X GET https://passpam.com/api/v1/attendees \
  -H "Authorization: Bearer "

PATCH /attendees/{uuid} Renomme le participant d’un billet valide

Organization key or member user token. · scope attendees:write · permission attendee.view · rate group: write

Body (JSON)

first_name string
last_name string
email string

curl -X PATCH https://passpam.com/api/v1/attendees/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

Refunds

GET /refunds Remboursements

Organization key or member user token. · scope refunds:read · permission finance.view · rate group: default

Query parameters

status string
order_id string
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/refunds \
  -H "Authorization: Bearer "

POST /refunds Demande un remboursement (workflow d’approbation inchangé)

Organization key or member user token. · scope refunds:write · permission finance.refund · rate group: sensitive

Body (JSON)

order_id string required
ticket_ids array — uuids (vide = toute la commande)
reason string required

curl -X POST https://passpam.com/api/v1/refunds \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /refunds/{uuid} Un remboursement

Organization key or member user token. · scope refunds:read · permission finance.view · rate group: default

curl -X GET https://passpam.com/api/v1/refunds/… \
  -H "Authorization: Bearer "

Check-in

POST /checkins/validate Valide un billet sans l’enregistrer (même moteur que le scanner)

Organization key or member user token. · scope checkins:write · permission checkin.scan · rate group: write

Body (JSON)

event_id string required — uuid
payload string — contenu du QR
ticket_id string — uuid (alternative au payload)
gate_id integer
access_zone_id integer
session_id string

curl -X POST https://passpam.com/api/v1/checkins/validate \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /checkins Enregistre une entrée (409 + code stable si refusée : ticket_already_used, checkin_qr_replaced, checkin_not_a_ticket…)

Organization key or member user token. · scope checkins:write · permission checkin.scan · rate group: write

Body (JSON)

event_id string required
payload string
ticket_id string
gate_id integer
scan_request_id string — idempotence du scan (8-100 car.)

curl -X POST https://passpam.com/api/v1/checkins \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /checkouts Enregistre une sortie

Organization key or member user token. · scope checkins:write · permission checkin.scan · rate group: write

Body (JSON)

event_id string required
payload string
ticket_id string
gate_id integer
scan_request_id string

curl -X POST https://passpam.com/api/v1/checkouts \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /events/{uuid}/checkins Historique des scans

Organization key or member user token. · scope checkins:read · permission checkin.stats.view · rate group: default

Query parameters

result string — accepted | rejected | duplicate | invalid
since datetime
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/events/…/checkins \
  -H "Authorization: Bearer "

GET /events/{uuid}/checkin-stats Statistiques de check-in en direct

Organization key or member user token. · scope checkins:read · permission checkin.stats.view · rate group: default

curl -X GET https://passpam.com/api/v1/events/…/checkin-stats \
  -H "Authorization: Bearer "

Resellers

GET /resellers Revendeurs de l’organisation

Organization key or member user token. · scope resellers:read · permission reseller.view · rate group: default

curl -X GET https://passpam.com/api/v1/resellers \
  -H "Authorization: Bearer "

GET /resellers/{uuid}/inventory Allocations d’un revendeur (« me » pour une clé revendeur)

Organization key or member user token. · scope inventory:read · permission reseller.view · rate group: default

Query parameters

event_id string

curl -X GET https://passpam.com/api/v1/resellers/…/inventory \
  -H "Authorization: Bearer "

POST /resellers/{uuid}/allocations Alloue du stock à un revendeur (InventoryService)

Organization key or member user token. · scope inventory:write · permission inventory.allocate · rate group: sensitive

Body (JSON)

ticket_type_id string required
quantity integer required

curl -X POST https://passpam.com/api/v1/resellers/…/allocations \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /reseller/inventory Clé revendeur : mon stock

Reseller account key (or reseller member). · scope inventory:read · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/inventory \
  -H "Authorization: Bearer "

GET /reseller/events Clé revendeur : événements autorisés

Reseller account key (or reseller member). · scope events:read · rate group: default

curl -X GET https://passpam.com/api/v1/reseller/events \
  -H "Authorization: Bearer "

GET /reseller/settlements Clé revendeur : mes règlements

Reseller account key (or reseller member). · scope resellers:read · rate group: default

Query parameters

page integer
per_page integer

curl -X GET https://passpam.com/api/v1/reseller/settlements \
  -H "Authorization: Bearer "

Reports

GET /reports/sales Ventes : KPI par devise, canaux, courbe, par événement (Phase 16)

Organization key or member user token. · scope reports:read · permission report.view · rate group: default

Query parameters

preset string — today | yesterday | 7d | 30d | month | last_month | year | custom
from string — YYYY-MM-DD
to string — YYYY-MM-DD
event_id string
channel string
currency string

curl -X GET https://passpam.com/api/v1/reports/sales \
  -H "Authorization: Bearer "

GET /reports/tickets Billets : performance par type + inventaire (grand livre)

Organization key or member user token. · scope reports:read · permission ticket.view · rate group: default

Query parameters

preset string — today | yesterday | 7d | 30d | month | last_month | year | custom
from string — YYYY-MM-DD
to string — YYYY-MM-DD
event_id string
channel string
currency string

curl -X GET https://passpam.com/api/v1/reports/tickets \
  -H "Authorization: Bearer "

GET /reports/checkins Check-in : taux, entrées dans le temps, portes, par type

Organization key or member user token. · scope reports:read · permission checkin.stats.view · rate group: default

Query parameters

preset string — today | yesterday | 7d | 30d | month | last_month | year | custom
from string — YYYY-MM-DD
to string — YYYY-MM-DD
event_id string
channel string
currency string
interval string — 1m | 5m | 15m | 1h

curl -X GET https://passpam.com/api/v1/reports/checkins \
  -H "Authorization: Bearer "

GET /reports/resellers Revendeurs : allocation, ventes, écoulement, points de vente, vendeurs

Organization key or member user token. · scope reports:read · permission reseller.view · rate group: default

Query parameters

preset string — today | yesterday | 7d | 30d | month | last_month | year | custom
from string — YYYY-MM-DD
to string — YYYY-MM-DD
event_id string
channel string
currency string

curl -X GET https://passpam.com/api/v1/reports/resellers \
  -H "Authorization: Bearer "

GET /reports/finance Finance : ventes, remboursements, paiements, solde (finance.view obligatoire)

Organization key or member user token. · scope reports:read · permission finance.view · rate group: sensitive

Query parameters

preset string — today | yesterday | 7d | 30d | month | last_month | year | custom
from string — YYYY-MM-DD
to string — YYYY-MM-DD
event_id string
channel string
currency string

curl -X GET https://passpam.com/api/v1/reports/finance \
  -H "Authorization: Bearer "

GET /events/{uuid}/reports/sales Rapport de ventes d’un événement (par type, par devise, canaux, check-in)

Organization key or member user token. · scope reports:read · permission report.view · rate group: default

curl -X GET https://passpam.com/api/v1/events/…/reports/sales \
  -H "Authorization: Bearer "

Webhooks

GET /webhooks/events Catalogue des événements de webhook

No authentication. · rate group: public

curl -X GET https://passpam.com/api/v1/webhooks/events

GET /webhooks Endpoints de webhook

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: default

curl -X GET https://passpam.com/api/v1/webhooks \
  -H "Authorization: Bearer "

POST /webhooks Crée un endpoint (le secret n’est renvoyé qu’une fois)

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: write

Body (JSON)

url string required — https
events array required — types ou ["*"]
name string
description string

curl -X POST https://passpam.com/api/v1/webhooks \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /webhooks/deliveries Journal des livraisons

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: default

Query parameters

endpoint_id string
status string — pending | processing | delivered | failed | cancelled
event_type string
page integer
per_page integer

curl -X GET https://passpam.com/api/v1/webhooks/deliveries \
  -H "Authorization: Bearer "

GET /webhooks/deliveries/{uuid} Une livraison avec son payload

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: default

curl -X GET https://passpam.com/api/v1/webhooks/deliveries/… \
  -H "Authorization: Bearer "

POST /webhooks/deliveries/{uuid}/replay Rejoue une livraison (même event_id, audité)

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/webhooks/deliveries/…/replay \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

GET /webhooks/{uuid} Un endpoint

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: default

curl -X GET https://passpam.com/api/v1/webhooks/… \
  -H "Authorization: Bearer "

PATCH /webhooks/{uuid} Modifie un endpoint (url, événements, statut)

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: write

Body (JSON)

url string
events array
name string
description string
status string — active | disabled

curl -X PATCH https://passpam.com/api/v1/webhooks/… \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

DELETE /webhooks/{uuid} Supprime un endpoint

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: write

curl -X DELETE https://passpam.com/api/v1/webhooks/… \
  -H "Authorization: Bearer "

POST /webhooks/{uuid}/rotate-secret Nouveau secret (affiché une fois)

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/webhooks/…/rotate-secret \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

POST /webhooks/{uuid}/test Envoie un événement webhook.test

Organization key or member user token. · scope webhooks:manage · permission webhook.manage · rate group: sensitive

curl -X POST https://passpam.com/api/v1/webhooks/…/test \
  -H "Authorization: Bearer " \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: " \
  -d '{…}'

Webhooks

Passpam POSTs a signed JSON body to every subscribed endpoint (Organizer › Integrations › Webhooks). Each delivery carries a unique event_id: deduplicate on it, arrival order is not guaranteed.

Event	Description
`event.published`	Événement publié
`event.updated`	Événement modifié (date, lieu…)
`event.cancelled`	Événement annulé
`order.created`	Commande créée (en attente de paiement)
`order.confirmed`	Commande confirmée
`order.cancelled`	Commande annulée
`payment.paid`	Paiement encaissé
`payment.failed`	Paiement échoué
`ticket.issued`	Billets émis
`ticket.checked_in`	Billet scanné (entrée acceptée)
`refund.requested`	Remboursement demandé
`refund.completed`	Remboursement effectué
`payout.paid`	Versement effectué
`inventory.low`	Stock bas
`inventory.sold_out`	Type de billet complet
`webhook.test`	Événement de test

Payload and headers

POST https://votre-serveur/webhooks/passpam
Content-Type: application/json
X-Passpam-Event: order.confirmed
X-Passpam-Event-Id: evt_3f2a9c…
X-Passpam-Delivery: 9d1c…-uuid
X-Passpam-Timestamp: 1790452740
X-Passpam-Signature: t=1790452740,v1=5f1b…hex(hmac-sha256)

{"event_id": "evt_3f2a9c…", "type": "order.confirmed", "api_version": "v1", "created_at": "2026-09-26T19:59:00Z", "livemode": true,
 "data": {"object": "order", "id": "…uuid…", "number": "PP-2026-…", "status": "confirmed", "total": {"amount": "10000.00", "currency": "HTG"}, "ticket_count": 2, "event": {"id": "…", "title": "…"}},
 "links": {"api": "https://passpam.com/api/v1/orders/…uuid…"}}

Verify the signature

X-Passpam-Signature = t=<Unix timestamp>,v1=<hex HMAC-SHA256 of “t.raw body” with your secret>. Reject any delivery whose timestamp is more than 5 minutes away (replay) or whose signature does not match (constant-time comparison).

// PHP
$sig = $_SERVER['HTTP_X_PASSPAM_SIGNATURE'];               // t=…,v1=…
$raw = file_get_contents('php://input');
preg_match('/^t=(\d+),v1=([a-f0-9]{64})$/', $sig, $m);
$ok = abs(time() - (int) $m[1]) <= 300
   && hash_equals(hash_hmac('sha256', $m[1] . '.' . $raw, $secret), $m[2]);

// Node.js
const [t, v1] = sig.split(',').map(p => p.split('=')[1]);
const expected = crypto.createHmac('sha256', secret).update(`${t}.${raw}`).digest('hex');
const ok = Math.abs(Date.now() / 1000 - Number(t)) <= 300 && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));

# Python
t, v1 = (p.split('=')[1] for p in sig.split(','))
expected = hmac.new(secret.encode(), f"{t}.{raw}".encode(), hashlib.sha256).hexdigest()
ok = abs(time.time() - int(t)) <= 300 and hmac.compare_digest(expected, v1)

Retried when your response is not 2xx or exceeds 10s: after 1 min, 5 min, 30 min, 2h, 12h (6 attempts), then status failed.
Order not guaranteed: process each event idempotently (event_id) and re-read the resource through links.api when needed.
Answer 2xx quickly (before any long processing); redirects are not followed.
After 10 consecutive final failures the endpoint is disabled and the owner notified; re-enable it from Organizer › Integrations.
You can replay a delivery (same event_id) and send a webhook.test event from the UI or the API.

Scopes

Scope	Description	Holders
`events:read`	Lire les événements et leurs types de billets	organization, reseller
`events:write`	Créer / modifier / publier / annuler des événements et types de billets	organization
`orders:read`	Lire les commandes	organization, reseller
`orders:write`	Créer et annuler des commandes	organization
`tickets:read`	Lire les billets (sans jeton sécurisé)	organization, reseller
`tickets:issue`	Émettre / renvoyer des billets	organization
`attendees:read`	Lire les participants (données minimisées)	organization
`attendees:write`	Modifier les participants	organization
`checkins:read`	Lire les statistiques et l’historique de check-in	organization
`checkins:write`	Valider / enregistrer des entrées et sorties	organization
`inventory:read`	Lire les disponibilités	organization, reseller
`inventory:write`	Allouer du stock à un revendeur (restreint)	organization
`payments:read`	Lire les paiements	organization
`payments:initiate`	Initier un paiement chez un fournisseur autorisé	organization
`payments:record`	Enregistrer un paiement hors ligne (fonds collectés par l’organisateur)	organization
`refunds:read`	Lire les remboursements	organization
`refunds:write`	Demander un remboursement	organization
`reports:read`	Lire les rapports de vente / check-in	organization
`resellers:read`	Lire les revendeurs, allocations et règlements	organization, reseller
`webhooks:manage`	Gérer les webhooks	organization

PHP, JavaScript and Python SDKs are planned; the API is designed to be generated from openapi.json.

Passpam API documentation v1

Authentication

API keys (server to server)

User tokens (Passpam app)

Conventions

Response envelope

Pagination, filters and sorting

Formats

Idempotency

Rate limits

Versioning and deprecation

Error codes

Meta

Public

Query parameters

Query parameters

Body (JSON)

Body (JSON)

Query parameters

Body (JSON)

Body (JSON)

Cashless

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Auth

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Me

Body (JSON)

Query parameters

Query parameters

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Query parameters

Body (JSON)

Query parameters

Body (JSON)

Mobile

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Query parameters

Body (JSON)

Body (JSON)

Query parameters

Organizer app

Body (JSON)

Query parameters

Body (JSON)

Body (JSON)

Checkout

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Scanner

Query parameters

Body (JSON)

Body (JSON)

Query parameters

Body (JSON)

Body (JSON)

Body (JSON)

Reseller POS

Events

Query parameters

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)

Body (JSON)