Authentication
A personal credential is supplied in body: public-guest-native-read-capability.
Connection guideParameters
originHeader · RequiredActual browser-supplied Origin. Required for canonical and bound observers; checked against configured canonical authority or the current native presentation binding.
stringFull definition
{ "type": "string", "maxLength": 2048, "example": "example" }
Request body
Required
Exact supported native resource and its current private capability. The body carries authority; browser account cookies and headers provide no fallback.
application/json
Full definition
{
"$ref": "#/components/schemas/IssuePublicGuestObserverTicketDto"
}Responses
200Private one-use origin-bound ticket and noncredential session binding. No native capability is returned.
Response headers
Cache-ControlThe credential-bearing response is never stored.
stringFull definition
{
"type": "string",
"enum": [
"no-store"
],
"example": "no-store"
}Full definition
{
"$ref": "#/components/schemas/PublicGuestObserverTicketDto"
}{
"ticket": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"expiresAt": "2026-12-31T18:00:00.000Z",
"scopeBinding": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}400Resource or capability shape is invalid.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 400,
"error": "errors:http.badRequest",
"code": "HTTP_BAD_REQUEST",
"message": "errors:http.badRequest",
"translationKey": "errors:http.badRequest"
}401Current observer authority is unavailable or expired.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 401,
"error": "errors:http.unauthorized",
"code": "HTTP_UNAUTHORIZED",
"message": "errors:http.unauthorized",
"translationKey": "errors:http.unauthorized"
}403Actual browser Origin is missing or denied.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 403,
"error": "errors:http.forbidden",
"code": "HTTP_FORBIDDEN",
"message": "errors:http.forbidden",
"translationKey": "errors:http.forbidden"
}404Native READ authority is unavailable without resource enumeration.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 404,
"error": "errors:http.notFound",
"code": "HTTP_NOT_FOUND",
"message": "errors:http.notFound",
"translationKey": "errors:http.notFound"
}429The native grant already owns six pending observer tickets.
Response headers
Retry-AfterWhole seconds the client must wait before retrying the rejected request.
integerFull definition
{
"type": "integer",
"minimum": 1,
"example": 60
}Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 429,
"error": "errors:http.tooManyRequests",
"code": "HTTP_TOO_MANY_REQUESTS",
"message": "errors:http.tooManyRequests",
"translationKey": "errors:http.tooManyRequests"
}503Bounded ticket issuance could not complete.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 503,
"error": "errors:http.serviceUnavailable",
"code": "HTTP_SERVICE_UNAVAILABLE",
"message": "errors:http.serviceUnavailable",
"translationKey": "errors:http.serviceUnavailable"
}Schemas
IssuePublicGuestObserverTicketDto
Private admission command carrying the current native READ capability for one scheduled preorder, reservation, waitlist entry or QR table session. The native owner verifies the exact resource and actual browser Origin before issuing an observer ticket; account and device credentials supply no authority.
kindRequiredNative resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.
allOfFull definition
{ "description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.", "allOf": [ { "$ref": "#/components/schemas/PublicObserverTicketResourceKind" } ], "example": "PREORDER" }resourceIdRequiredExact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.
string · uuidFull definition
{ "type": "string", "format": "uuid", "description": "Exact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.", "example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568" }capabilityRequiredPrivate current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.
stringFull definition
{ "type": "string", "minLength": 20, "maxLength": 1024, "writeOnly": true, "description": "Private current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.", "example": "https://example.test/resource" }
Full definition
{
"type": "object",
"properties": {
"kind": {
"description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.",
"allOf": [
{
"$ref": "#/components/schemas/PublicObserverTicketResourceKind"
}
],
"example": "PREORDER"
},
"resourceId": {
"type": "string",
"format": "uuid",
"description": "Exact native preorder fulfillment, reservation, waitlist entry or table session UUID. The current capability must own this resource.",
"example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568"
},
"capability": {
"type": "string",
"minLength": 20,
"maxLength": 1024,
"writeOnly": true,
"description": "Private current native READ capability for the selected resource. Submit directly in this command body; keep it outside URLs, Redux, logs and browser account authentication.",
"example": "https://example.test/resource"
}
},
"description": "Private admission command carrying the current native READ capability for one scheduled preorder, reservation, waitlist entry or QR table session. The native owner verifies the exact resource and actual browser Origin before issuing an observer ticket; account and device credentials supply no authority.",
"required": [
"kind",
"resourceId",
"capability"
],
"example": {
"kind": "PREORDER",
"resourceId": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568",
"capability": "https://example.test/resource"
}
}PublicObserverTicketResourceKind
Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.
Full definition
{
"type": "string",
"enum": [
"PREORDER",
"RESERVATION",
"WAITLIST",
"TABLE_SESSION"
],
"description": "Native resource family with implemented observer admission, authorized by the submitted current READ capability. Scheduled preorder, reservation, waitlist and table session sources are each verified by their owning domain.",
"example": "PREORDER"
}PublicGuestObserverTicketDto
Private receipt for one origin-bound, one-use native resource observer upgrade. The database deadline limits ticket admission, while any live resource lease remains bounded by current native and presentation authority. The scope binding identifies a noncredential session namespace.
ticketRequiredPrivate one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux.
stringFull definition
{ "type": "string", "minLength": 49, "maxLength": 49, "pattern": "^gpot1_[A-Za-z0-9_-]{43}$", "example": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "description": "Private one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux." }expiresAtRequiredDatabase-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.
string · date-timeFull definition
{ "type": "string", "format": "date-time", "description": "Database-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.", "example": "2026-12-31T18:00:00.000Z" }scopeBindingRequiredNoncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required.
stringFull definition
{ "type": "string", "minLength": 49, "maxLength": 49, "pattern": "^gpos1_[A-Za-z0-9_-]{43}$", "example": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "description": "Noncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required." }
Full definition
{
"type": "object",
"properties": {
"ticket": {
"type": "string",
"minLength": 49,
"maxLength": 49,
"pattern": "^gpot1_[A-Za-z0-9_-]{43}$",
"example": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"description": "Private one-use upgrade ticket. Offer it as a separate WebSocket subprotocol alongside hallify.socket.v1; the server returns only the stable protocol. Keep this value in memory and outside URLs, cookies and Redux."
},
"expiresAt": {
"type": "string",
"format": "date-time",
"description": "Database-issued admission deadline, at most thirty seconds and no later than the currently authorized native and presentation deadlines. This is not a live lease expiry.",
"example": "2026-12-31T18:00:00.000Z"
},
"scopeBinding": {
"type": "string",
"minLength": 49,
"maxLength": 49,
"pattern": "^gpos1_[A-Za-z0-9_-]{43}$",
"example": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"description": "Noncredential resource-authority binding for the Socket session scope. Append a colon and a nonempty client context of at most 128 characters; current native admission is still required."
}
},
"description": "Private receipt for one origin-bound, one-use native resource observer upgrade. The database deadline limits ticket admission, while any live resource lease remains bounded by current native and presentation authority. The scope binding identifies a noncredential session namespace.",
"required": [
"ticket",
"expiresAt",
"scopeBinding"
],
"example": {
"ticket": "gpot1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"expiresAt": "2026-12-31T18:00:00.000Z",
"scopeBinding": "gpos1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}
}TranslatedErrorDto
Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.
statusCodeRequiredHTTP status code repeated from the response.
integerFull definition
{ "type": "integer", "description": "HTTP status code repeated from the response.", "example": 400 }errorRequiredTranslation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.
stringFull definition
{ "type": "string", "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.", "example": "errors.request.invalid" }codeRequiredStable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.
stringFull definition
{ "type": "string", "example": "HTTP_BAD_REQUEST", "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions." }messageRequiredTranslation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.
stringFull definition
{ "type": "string", "example": "errors:http.badRequest", "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application." }translationKeyRequiredCanonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.
stringFull definition
{ "type": "string", "example": "errors:http.badRequest", "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback." }translationValuesOptionalOptional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.
objectFull definition
{ "type": "object", "additionalProperties": { "oneOf": [ { "type": "string", "example": "example" }, { "type": "number", "example": 0 }, { "type": "boolean", "example": true } ], "example": "example" }, "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.", "example": { "exampleKey": "example" } }validationErrorsOptionalField validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.
arrayFull definition
{ "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.", "type": "array", "items": { "$ref": "#/components/schemas/ValidationErrorDto" }, "example": [ { "field": "email", "translationKey": "validation:isEmail", "code": "isEmail", "message": "validation:isEmail" } ] }detailsOptionalOptional domain-specific blocker or validation details
oneOfFull definition
{ "description": "Optional domain-specific blocker or validation details", "oneOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/JsonValue" }, "example": [ "example" ] }, { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/JsonValue" }, "example": { "exampleKey": "example" } } ], "example": [ "example" ] }
Full definition
{
"type": "object",
"properties": {
"statusCode": {
"type": "integer",
"description": "HTTP status code repeated from the response.",
"example": 400
},
"error": {
"type": "string",
"description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
"example": "errors.request.invalid"
},
"code": {
"type": "string",
"example": "HTTP_BAD_REQUEST",
"description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
},
"message": {
"type": "string",
"example": "errors:http.badRequest",
"description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
},
"translationKey": {
"type": "string",
"example": "errors:http.badRequest",
"description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
},
"translationValues": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"type": "string",
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
}
],
"example": "example"
},
"description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
"example": {
"exampleKey": "example"
}
},
"validationErrors": {
"description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
"type": "array",
"items": {
"$ref": "#/components/schemas/ValidationErrorDto"
},
"example": [
{
"field": "email",
"translationKey": "validation:isEmail",
"code": "isEmail",
"message": "validation:isEmail"
}
]
},
"details": {
"description": "Optional domain-specific blocker or validation details",
"oneOf": [
{
"type": "array",
"items": {
"$ref": "#/components/schemas/JsonValue"
},
"example": [
"example"
]
},
{
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/JsonValue"
},
"example": {
"exampleKey": "example"
}
}
],
"example": [
"example"
]
}
},
"required": [
"statusCode",
"error",
"code",
"message",
"translationKey"
],
"description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
"example": {
"statusCode": 400,
"error": "errors:http.badRequest",
"code": "HTTP_BAD_REQUEST",
"message": "errors:http.badRequest",
"translationKey": "errors:http.badRequest"
}
}ValidationErrorDto
Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.
fieldRequiredPublic field path. Nested properties and array indices are separated by dots.
stringFull definition
{ "type": "string", "example": "email", "description": "Public field path. Nested properties and array indices are separated by dots." }translationKeyRequiredTranslation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.
stringFull definition
{ "type": "string", "example": "validation:isEmail", "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog." }codeRequiredStable validator identifier for this field failure. Custom validators may define additional identifiers.
stringFull definition
{ "type": "string", "example": "isEmail", "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers." }messageRequiredTranslation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.
stringFull definition
{ "type": "string", "example": "validation:isEmail", "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included." }translationValuesOptionalOptional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.
objectFull definition
{ "type": "object", "additionalProperties": { "oneOf": [ { "type": "string", "example": "example" }, { "type": "number", "example": 0 }, { "type": "boolean", "example": true } ], "example": "example" }, "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.", "example": { "exampleKey": "example" } }
Full definition
{
"type": "object",
"properties": {
"field": {
"type": "string",
"example": "email",
"description": "Public field path. Nested properties and array indices are separated by dots."
},
"translationKey": {
"type": "string",
"example": "validation:isEmail",
"description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
},
"code": {
"type": "string",
"example": "isEmail",
"description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
},
"message": {
"type": "string",
"example": "validation:isEmail",
"description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
},
"translationValues": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"type": "string",
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
}
],
"example": "example"
},
"description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
"example": {
"exampleKey": "example"
}
}
},
"required": [
"field",
"translationKey",
"code",
"message"
],
"description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
"example": {
"field": "email",
"translationKey": "validation:isEmail",
"code": "isEmail",
"message": "validation:isEmail"
}
}JsonValue
Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.
Full definition
{
"oneOf": [
{
"type": "string",
"nullable": true,
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/JsonValue"
},
"example": [
"example"
]
},
{
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/JsonValue"
},
"example": {
"exampleKey": "example"
}
}
],
"description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
"example": "example"
}