Open native guest payment access

Private native guest capability admission for payment-purpose access. This creates no checkout, consent acceptance or provider operation.

kindRequired

Existing native source owner: QR membership, preorder manage, or reservation manage for its exact payment guarantee.

allOf

Full definition

{
  "description": "Existing native source owner: QR membership, preorder manage, or reservation manage for its exact payment guarantee.",
  "allOf": [
    {
      "$ref": "#/components/schemas/GuestPaymentSourceKind"
    }
  ],
  "example": "QR_MEMBERSHIP"
}

resourceIdRequired

Exact native table-session UUID for QR, fulfillment UUID for a preorder, or reservation UUID for its guarantee.

string · uuid

Full definition

{
  "type": "string",
  "format": "uuid",
  "description": "Exact native table-session UUID for QR, fulfillment UUID for a preorder, or reservation UUID for its guarantee.",
  "example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568"
}

capabilityRequired

Current private native membership/manage capability. It remains outside URLs, account authentication, logs and global client state.

string

Full definition

{
  "type": "string",
  "minLength": 20,
  "maxLength": 8192,
  "writeOnly": true,
  "description": "Current private native membership/manage capability. It remains outside URLs, account authentication, logs and global client state.",
  "example": "https://example.test/resource"
}

{
  "type": "object",
  "properties": {
    "kind": {
      "description": "Existing native source owner: QR membership, preorder manage, or reservation manage for its exact payment guarantee.",
      "allOf": [
        {
          "$ref": "#/components/schemas/GuestPaymentSourceKind"
        }
      ],
      "example": "QR_MEMBERSHIP"
    },
    "resourceId": {
      "type": "string",
      "format": "uuid",
      "description": "Exact native table-session UUID for QR, fulfillment UUID for a preorder, or reservation UUID for its guarantee.",
      "example": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568"
    },
    "capability": {
      "type": "string",
      "minLength": 20,
      "maxLength": 8192,
      "writeOnly": true,
      "description": "Current private native membership/manage capability. It remains outside URLs, account authentication, logs and global client state.",
      "example": "https://example.test/resource"
    }
  },
  "description": "Private native guest capability admission for payment-purpose access. This creates no checkout, consent acceptance or provider operation.",
  "required": [
    "kind",
    "resourceId",
    "capability"
  ],
  "example": {
    "kind": "QR_MEMBERSHIP",
    "resourceId": "d5b5eb29-9b8d-4d6f-8f4f-6f0e58f32568",
    "capability": "https://example.test/resource"
  }
}

Existing native source owner: QR membership, preorder manage, or reservation manage for its exact payment guarantee.

{
  "type": "string",
  "enum": [
    "QR_MEMBERSHIP",
    "PREORDER_MANAGE",
    "RESERVATION_MANAGE"
  ],
  "description": "Existing native source owner: QR membership, preorder manage, or reservation manage for its exact payment guarantee.",
  "example": "QR_MEMBERSHIP"
}

Private origin-bound payment access receipt. This capability alone never accepts a financial offer or authorizes a new charge.

accessIdRequired

Noncredential access context UUID. Possession of this identifier grants no access.

string · uuid

Full definition

{
  "type": "string",
  "format": "uuid",
  "description": "Noncredential access context UUID. Possession of this identifier grants no access.",
  "example": "b93bc84d-84db-4161-840b-c3c7a7875b1d"
}

capabilityRequired

Private body-issued capability consumed by the matching payment adapter. Persist only in its bounded private tab context, never in URLs, cookies, Redux or logs.

string

Full definition

{
  "type": "string",
  "minLength": 48,
  "maxLength": 48,
  "pattern": "^gpa1_[A-Za-z0-9_-]{43}$",
  "example": "gpa1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  "description": "Private body-issued capability consumed by the matching payment adapter. Persist only in its bounded private tab context, never in URLs, cookies, Redux or logs."
}

expiresAtRequired

Common access and own-original-receipt deadline, at most twenty-four hours after issuance and no later than native/presentation authority. Receipt disclosure still requires exact consumed consent/Core links and current original native authority. This deadline does not extend financial consent.

string · date-time

Full definition

{
  "type": "string",
  "format": "date-time",
  "description": "Common access and own-original-receipt deadline, at most twenty-four hours after issuance and no later than native/presentation authority. Receipt disclosure still requires exact consumed consent/Core links and current original native authority. This deadline does not extend financial consent.",
  "example": "2026-12-31T18:00:00.000Z"
}

financialExpiresAtRequired

Deadline for PREPARE/ACCEPT and new financial permits, at most fifteen minutes after the original access issuance and bounded by native/presentation authority. It may already be past on an own-receipt handoff/recovery response; no new financial command is then allowed.

string · date-time

Full definition

{
  "type": "string",
  "format": "date-time",
  "description": "Deadline for PREPARE/ACCEPT and new financial permits, at most fifteen minutes after the original access issuance and bounded by native/presentation authority. It may already be past on an own-receipt handoff/recovery response; no new financial command is then allowed.",
  "example": "2026-12-31T18:00:00.000Z"
}

transportOriginRequired

Exact allowed request origin for this capability. Handoff changes only this transport audience, preserving original native provenance.

string · uri

Full definition

{
  "type": "string",
  "format": "uri",
  "description": "Exact allowed request origin for this capability. Handoff changes only this transport audience, preserving original native provenance.",
  "example": "https://example.test/resource"
}

{
  "type": "object",
  "properties": {
    "accessId": {
      "type": "string",
      "format": "uuid",
      "description": "Noncredential access context UUID. Possession of this identifier grants no access.",
      "example": "b93bc84d-84db-4161-840b-c3c7a7875b1d"
    },
    "capability": {
      "type": "string",
      "minLength": 48,
      "maxLength": 48,
      "pattern": "^gpa1_[A-Za-z0-9_-]{43}$",
      "example": "gpa1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
      "description": "Private body-issued capability consumed by the matching payment adapter. Persist only in its bounded private tab context, never in URLs, cookies, Redux or logs."
    },
    "expiresAt": {
      "type": "string",
      "format": "date-time",
      "description": "Common access and own-original-receipt deadline, at most twenty-four hours after issuance and no later than native/presentation authority. Receipt disclosure still requires exact consumed consent/Core links and current original native authority. This deadline does not extend financial consent.",
      "example": "2026-12-31T18:00:00.000Z"
    },
    "financialExpiresAt": {
      "type": "string",
      "format": "date-time",
      "description": "Deadline for PREPARE/ACCEPT and new financial permits, at most fifteen minutes after the original access issuance and bounded by native/presentation authority. It may already be past on an own-receipt handoff/recovery response; no new financial command is then allowed.",
      "example": "2026-12-31T18:00:00.000Z"
    },
    "transportOrigin": {
      "type": "string",
      "format": "uri",
      "description": "Exact allowed request origin for this capability. Handoff changes only this transport audience, preserving original native provenance.",
      "example": "https://example.test/resource"
    }
  },
  "description": "Private origin-bound payment access receipt. This capability alone never accepts a financial offer or authorizes a new charge.",
  "required": [
    "accessId",
    "capability",
    "expiresAt",
    "financialExpiresAt",
    "transportOrigin"
  ],
  "example": {
    "accessId": "b93bc84d-84db-4161-840b-c3c7a7875b1d",
    "capability": "gpa1_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "expiresAt": "2026-12-31T18:00:00.000Z",
    "financialExpiresAt": "2026-12-31T18:00:00.000Z",
    "transportOrigin": "https://example.test/resource"
  }
}

Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.

statusCodeRequired

HTTP status code repeated from the response.

integer

Full definition

{
  "type": "integer",
  "description": "HTTP status code repeated from the response.",
  "example": 400
}

errorRequired

Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.

string

Full definition

{
  "type": "string",
  "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
  "example": "errors.request.invalid"
}

codeRequired

Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.

string

Full definition

{
  "type": "string",
  "example": "HTTP_BAD_REQUEST",
  "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
}

messageRequired

Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.

string

Full definition

{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
}

translationKeyRequired

Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.

string

Full definition

{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
}

translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object

Full definition

{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}

validationErrorsOptional

Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.

array

Full definition

{
  "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
  "type": "array",
  "items": {
    "$ref": "#/components/schemas/ValidationErrorDto"
  },
  "example": [
    {
      "field": "email",
      "translationKey": "validation:isEmail",
      "code": "isEmail",
      "message": "validation:isEmail"
    }
  ]
}

detailsOptional

Optional domain-specific blocker or validation details

oneOf

Full definition

{
  "description": "Optional domain-specific blocker or validation details",
  "oneOf": [
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "example": [
    "example"
  ]
}

{
  "type": "object",
  "properties": {
    "statusCode": {
      "type": "integer",
      "description": "HTTP status code repeated from the response.",
      "example": 400
    },
    "error": {
      "type": "string",
      "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
      "example": "errors.request.invalid"
    },
    "code": {
      "type": "string",
      "example": "HTTP_BAD_REQUEST",
      "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
    },
    "message": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
    },
    "translationKey": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    },
    "validationErrors": {
      "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/ValidationErrorDto"
      },
      "example": [
        {
          "field": "email",
          "translationKey": "validation:isEmail",
          "code": "isEmail",
          "message": "validation:isEmail"
        }
      ]
    },
    "details": {
      "description": "Optional domain-specific blocker or validation details",
      "oneOf": [
        {
          "type": "array",
          "items": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": [
            "example"
          ]
        },
        {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": {
            "exampleKey": "example"
          }
        }
      ],
      "example": [
        "example"
      ]
    }
  },
  "required": [
    "statusCode",
    "error",
    "code",
    "message",
    "translationKey"
  ],
  "description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
  "example": {
    "statusCode": 400,
    "error": "errors:http.badRequest",
    "code": "HTTP_BAD_REQUEST",
    "message": "errors:http.badRequest",
    "translationKey": "errors:http.badRequest"
  }
}

Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.

fieldRequired

Public field path. Nested properties and array indices are separated by dots.

string

Full definition

{
  "type": "string",
  "example": "email",
  "description": "Public field path. Nested properties and array indices are separated by dots."
}

translationKeyRequired

Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.

string

Full definition

{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
}

codeRequired

Stable validator identifier for this field failure. Custom validators may define additional identifiers.

string

Full definition

{
  "type": "string",
  "example": "isEmail",
  "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
}

messageRequired

Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.

string

Full definition

{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
}

translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object

Full definition

{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}

{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "example": "email",
      "description": "Public field path. Nested properties and array indices are separated by dots."
    },
    "translationKey": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
    },
    "code": {
      "type": "string",
      "example": "isEmail",
      "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
    },
    "message": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    }
  },
  "required": [
    "field",
    "translationKey",
    "code",
    "message"
  ],
  "description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
  "example": {
    "field": "email",
    "translationKey": "validation:isEmail",
    "code": "isEmail",
    "message": "validation:isEmail"
  }
}

Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.

{
  "oneOf": [
    {
      "type": "string",
      "nullable": true,
      "example": "example"
    },
    {
      "type": "number",
      "example": 0
    },
    {
      "type": "boolean",
      "example": true
    },
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
  "example": "example"
}