Skip to content
Sections

Guest resource observers

Issue a native resource observer ticket

POST/public/guest-observers/tickets

Verifies the current native READ capability and exact browser Origin in one transaction, then issues a one-use Socket upgrade ticket for that resource. Canonical and bound presentation provenance are checked by the native owner. A retired, rotated, replay-only or unclassified source cannot observe. The ticket authorizes no business commands and creates no account or transport cookie.

Authentication

A personal credential is supplied in body: public-guest-native-read-capability.

Connection guide

Parameters

originHeader · Required

Actual browser-supplied Origin. Required for canonical and bound observers; checked against configured canonical authority or the current native presentation binding.

string
Full definition
{
  "type": "string",
  "maxLength": 2048,
  "example": "example"
}

Request body

Required

Exact supported native resource and its current private capability. The body carries authority; browser account cookies and headers provide no fallback.

application/json

IssuePublicGuestObserverTicketDto
Full definition
{
  "$ref": "#/components/schemas/IssuePublicGuestObserverTicketDto"
}

Responses

200Private one-use origin-bound ticket and noncredential session binding. No native capability is returned.

Response headers

Cache-Control

The credential-bearing response is never stored.

string
Full definition
{
  "type": "string",
  "enum": [
    "no-store"
  ],
  "example": "no-store"
}
PublicGuestObserverTicketDto
Full definition
{
  "$ref": "#/components/schemas/PublicGuestObserverTicketDto"
}
Example response · 200 · application/json
{
  "ticket": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  "expiresAt": "2026-12-31T18:00:00.000Z",
  "scopeBinding": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}
400Resource or capability shape is invalid.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 400 · application/json
{
  "statusCode": 400,
  "error": "errors:http.badRequest",
  "code": "HTTP_BAD_REQUEST",
  "message": "errors:http.badRequest",
  "translationKey": "errors:http.badRequest"
}
401Current observer authority is unavailable or expired.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 401 · application/json
{
  "statusCode": 401,
  "error": "errors:http.unauthorized",
  "code": "HTTP_UNAUTHORIZED",
  "message": "errors:http.unauthorized",
  "translationKey": "errors:http.unauthorized"
}
403Actual browser Origin is missing or denied.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 403 · application/json
{
  "statusCode": 403,
  "error": "errors:http.forbidden",
  "code": "HTTP_FORBIDDEN",
  "message": "errors:http.forbidden",
  "translationKey": "errors:http.forbidden"
}
404Native READ authority is unavailable without resource enumeration.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 404 · application/json
{
  "statusCode": 404,
  "error": "errors:http.notFound",
  "code": "HTTP_NOT_FOUND",
  "message": "errors:http.notFound",
  "translationKey": "errors:http.notFound"
}
429The native grant already owns six pending observer tickets.

Response headers

Retry-After

Whole seconds the client must wait before retrying the rejected request.

integer
Full definition
{
  "type": "integer",
  "minimum": 1,
  "example": 60
}
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 429 · application/json
{
  "statusCode": 429,
  "error": "errors:http.tooManyRequests",
  "code": "HTTP_TOO_MANY_REQUESTS",
  "message": "errors:http.tooManyRequests",
  "translationKey": "errors:http.tooManyRequests"
}
503Bounded ticket issuance could not complete.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 503 · application/json
{
  "statusCode": 503,
  "error": "errors:http.serviceUnavailable",
  "code": "HTTP_SERVICE_UNAVAILABLE",
  "message": "errors:http.serviceUnavailable",
  "translationKey": "errors:http.serviceUnavailable"
}

Schemas

IssuePublicGuestObserverTicketDto

Private admission command carrying the current native READ capability for one scheduled preorder, reservation, waitlist entry or QR table session. The native owner verifies the exact resource and actual browser Origin before issuing an observer ticket; account and device credentials supply no authority.

kindRequired

Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.

allOf
Full definition
{
  "description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.",
  "allOf": [
    {
      "$ref": "#/components/schemas/PublicObserverTicketResourceKind"
    }
  ],
  "example": "PREORDER"
}
resourceIdRequired

Exact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.

string · uuid
Full definition
{
  "type": "string",
  "format": "uuid",
  "description": "Exact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.",
  "example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568"
}
capabilityRequired

Private current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.

string
Full definition
{
  "type": "string",
  "minLength": 20,
  "maxLength": 1024,
  "writeOnly": true,
  "description": "Private current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.",
  "example": "https://example.test/resource"
}
Full definition
{
  "type": "object",
  "properties": {
    "kind": {
      "description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.",
      "allOf": [
        {
          "$ref": "#/components/schemas/PublicObserverTicketResourceKind"
        }
      ],
      "example": "PREORDER"
    },
    "resourceId": {
      "type": "string",
      "format": "uuid",
      "description": "Exact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.",
      "example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568"
    },
    "capability": {
      "type": "string",
      "minLength": 20,
      "maxLength": 1024,
      "writeOnly": true,
      "description": "Private current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.",
      "example": "https://example.test/resource"
    }
  },
  "description": "Private admission command carrying the current native READ capability for one scheduled preorder, reservation, waitlist entry or QR table session. The native owner verifies the exact resource and actual browser Origin before issuing an observer ticket; account and device credentials supply no authority.",
  "required": [
    "kind",
    "resourceId",
    "capability"
  ],
  "example": {
    "kind": "PREORDER",
    "resourceId": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568",
    "capability": "https://example.test/resource"
  }
}
PublicObserverTicketResourceKind

Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.

Full definition
{
  "type": "string",
  "enum": [
    "PREORDER",
    "RESERVATION",
    "WAITLIST",
    "TABLE_SESSION"
  ],
  "description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.",
  "example": "PREORDER"
}
PublicGuestObserverTicketDto

Private receipt for one origin-bound, one-use native resource observer upgrade. The database deadline limits ticket admission, while any live resource lease remains bounded by current native and presentation authority. The scope binding identifies a noncredential session namespace.

ticketRequired

Private one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux.

string
Full definition
{
  "type": "string",
  "minLength": 49,
  "maxLength": 49,
  "pattern": "^gpot1_[A-Za-z0-9_-]{43}$",
  "example": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  "description": "Private one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux."
}
expiresAtRequired

Database-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.

string · date-time
Full definition
{
  "type": "string",
  "format": "date-time",
  "description": "Database-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.",
  "example": "2026-12-31T18:00:00.000Z"
}
scopeBindingRequired

Noncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required.

string
Full definition
{
  "type": "string",
  "minLength": 49,
  "maxLength": 49,
  "pattern": "^gpos1_[A-Za-z0-9_-]{43}$",
  "example": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  "description": "Noncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required."
}
Full definition
{
  "type": "object",
  "properties": {
    "ticket": {
      "type": "string",
      "minLength": 49,
      "maxLength": 49,
      "pattern": "^gpot1_[A-Za-z0-9_-]{43}$",
      "example": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
      "description": "Private one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux."
    },
    "expiresAt": {
      "type": "string",
      "format": "date-time",
      "description": "Database-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.",
      "example": "2026-12-31T18:00:00.000Z"
    },
    "scopeBinding": {
      "type": "string",
      "minLength": 49,
      "maxLength": 49,
      "pattern": "^gpos1_[A-Za-z0-9_-]{43}$",
      "example": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
      "description": "Noncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required."
    }
  },
  "description": "Private receipt for one origin-bound, one-use native resource observer upgrade. The database deadline limits ticket admission, while any live resource lease remains bounded by current native and presentation authority. The scope binding identifies a noncredential session namespace.",
  "required": [
    "ticket",
    "expiresAt",
    "scopeBinding"
  ],
  "example": {
    "ticket": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "expiresAt": "2026-12-31T18:00:00.000Z",
    "scopeBinding": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
  }
}
TranslatedErrorDto

Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.

statusCodeRequired

HTTP status code repeated from the response.

integer
Full definition
{
  "type": "integer",
  "description": "HTTP status code repeated from the response.",
  "example": 400
}
errorRequired

Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.

string
Full definition
{
  "type": "string",
  "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
  "example": "errors.request.invalid"
}
codeRequired

Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.

string
Full definition
{
  "type": "string",
  "example": "HTTP_BAD_REQUEST",
  "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
}
messageRequired

Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
}
translationKeyRequired

Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
validationErrorsOptional

Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.

array
Full definition
{
  "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
  "type": "array",
  "items": {
    "$ref": "#/components/schemas/ValidationErrorDto"
  },
  "example": [
    {
      "field": "email",
      "translationKey": "validation:isEmail",
      "code": "isEmail",
      "message": "validation:isEmail"
    }
  ]
}
detailsOptional

Optional domain-specific blocker or validation details

oneOf
Full definition
{
  "description": "Optional domain-specific blocker or validation details",
  "oneOf": [
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "example": [
    "example"
  ]
}
Full definition
{
  "type": "object",
  "properties": {
    "statusCode": {
      "type": "integer",
      "description": "HTTP status code repeated from the response.",
      "example": 400
    },
    "error": {
      "type": "string",
      "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
      "example": "errors.request.invalid"
    },
    "code": {
      "type": "string",
      "example": "HTTP_BAD_REQUEST",
      "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
    },
    "message": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
    },
    "translationKey": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    },
    "validationErrors": {
      "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/ValidationErrorDto"
      },
      "example": [
        {
          "field": "email",
          "translationKey": "validation:isEmail",
          "code": "isEmail",
          "message": "validation:isEmail"
        }
      ]
    },
    "details": {
      "description": "Optional domain-specific blocker or validation details",
      "oneOf": [
        {
          "type": "array",
          "items": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": [
            "example"
          ]
        },
        {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": {
            "exampleKey": "example"
          }
        }
      ],
      "example": [
        "example"
      ]
    }
  },
  "required": [
    "statusCode",
    "error",
    "code",
    "message",
    "translationKey"
  ],
  "description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
  "example": {
    "statusCode": 400,
    "error": "errors:http.badRequest",
    "code": "HTTP_BAD_REQUEST",
    "message": "errors:http.badRequest",
    "translationKey": "errors:http.badRequest"
  }
}
ValidationErrorDto

Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.

fieldRequired

Public field path. Nested properties and array indices are separated by dots.

string
Full definition
{
  "type": "string",
  "example": "email",
  "description": "Public field path. Nested properties and array indices are separated by dots."
}
translationKeyRequired

Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
}
codeRequired

Stable validator identifier for this field failure. Custom validators may define additional identifiers.

string
Full definition
{
  "type": "string",
  "example": "isEmail",
  "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
}
messageRequired

Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
Full definition
{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "example": "email",
      "description": "Public field path. Nested properties and array indices are separated by dots."
    },
    "translationKey": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
    },
    "code": {
      "type": "string",
      "example": "isEmail",
      "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
    },
    "message": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    }
  },
  "required": [
    "field",
    "translationKey",
    "code",
    "message"
  ],
  "description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
  "example": {
    "field": "email",
    "translationKey": "validation:isEmail",
    "code": "isEmail",
    "message": "validation:isEmail"
  }
}
JsonValue

Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.

Full definition
{
  "oneOf": [
    {
      "type": "string",
      "nullable": true,
      "example": "example"
    },
    {
      "type": "number",
      "example": 0
    },
    {
      "type": "boolean",
      "example": true
    },
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
  "example": "example"
}

Hallify uses essential cookies and optional analytics.

Essential cookies keep sign-in, locale, and theme preferences working. Analytics is off until you choose to allow it.