Skip to content
HallifyDevelopersSearch documentation
Open Hallify
Sections

Guest portal

Confirm targeted Guest Portal reentry

POST/guest-portal/notifications/reentry/confirm

Consumes one purpose-bound real code after current identity, original existing contact and its exact version, venue scope and portal or installation authority checks. A candidate contact gains assurance only through successful OTP confirmation. Failed attempts commit their budget. Successful consumption and a rotated short-lived portal continuation commit atomically; an authorized exact recovery returns the original continuation without another rotation or extension. This never invokes booking identity creation, creates push authority or transfers a revoked installation.

Authentication

A personal credential is supplied in body: guest-portal-reentry-one-time-code.

Connection guide

Parameters

No path, query or ordinary header parameters. See authentication and request body below.

Request body

Required

One-time reentry code bound to the original existing contact, its exact version and portal scope.

application/json

GuestPortalReentryConfirmationDto
Full definition
{
  "$ref": "#/components/schemas/GuestPortalReentryConfirmationDto"
}

Responses

200A new scoped Guest Portal continuation.
GuestPortalReentryContinuationDto
Full definition
{
  "$ref": "#/components/schemas/GuestPortalReentryContinuationDto"
}
Example response · 200 · application/json
{
  "token": "synthetic-example-credential",
  "expiresAt": "2026-12-31T18:00:00.000Z"
}
400Invalid input or one-time code; no guest or contact is disclosed.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 400 · application/json
{
  "statusCode": 400,
  "error": "errors:http.badRequest",
  "code": "HTTP_BAD_REQUEST",
  "message": "errors:http.badRequest",
  "translationKey": "errors:http.badRequest"
}
429The bounded IP or hint verification budget is exhausted.

Response headers

Retry-After

Whole seconds the client must wait before retrying the rejected request.

integer
Full definition
{
  "type": "integer",
  "minimum": 1,
  "example": 60
}
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 429 · application/json
{
  "statusCode": 429,
  "error": "errors:http.tooManyRequests",
  "code": "HTTP_TOO_MANY_REQUESTS",
  "message": "errors:http.tooManyRequests",
  "translationKey": "errors:http.tooManyRequests"
}
503The notification capability is unavailable.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 503 · application/json
{
  "statusCode": 503,
  "error": "errors:http.serviceUnavailable",
  "code": "HTTP_SERVICE_UNAVAILABLE",
  "message": "errors:http.serviceUnavailable",
  "translationKey": "errors:http.serviceUnavailable"
}

Schemas

GuestPortalReentryConfirmationDto

Purpose-bound one-time code confirmation for the original verified guest contact.

requestIdRequired

Original one-time request identity.

string · uuid
Full definition
{
  "type": "string",
  "description": "Original one-time request identity.",
  "format": "uuid",
  "example": "8b92d522-894a-427c-8509-9f0795659b5b"
}
codeRequired

One-time code sent to the original verified contact.

string
Full definition
{
  "type": "string",
  "description": "One-time code sent to the original verified contact.",
  "pattern": "^[0-9]{6}$",
  "minLength": 6,
  "maxLength": 6,
  "writeOnly": true,
  "example": "000001"
}
Full definition
{
  "type": "object",
  "properties": {
    "requestId": {
      "type": "string",
      "description": "Original one-time request identity.",
      "format": "uuid",
      "example": "8b92d522-894a-427c-8509-9f0795659b5b"
    },
    "code": {
      "type": "string",
      "description": "One-time code sent to the original verified contact.",
      "pattern": "^[0-9]{6}$",
      "minLength": 6,
      "maxLength": 6,
      "writeOnly": true,
      "example": "000001"
    }
  },
  "description": "Purpose-bound one-time code confirmation for the original verified guest contact.",
  "required": [
    "requestId",
    "code"
  ],
  "example": {
    "requestId": "8b92d522-894a-427c-8509-9f0795659b5b",
    "code": "000001"
  }
}
GuestPortalReentryContinuationDto

New private Guest Portal continuation after atomic one-time verification.

tokenRequired

New short-lived Guest Portal continuation; retain privately in the portal session only.

string
Full definition
{
  "type": "string",
  "description": "New short-lived Guest Portal continuation; retain privately in the portal session only.",
  "readOnly": true,
  "example": "synthetic-example-credential"
}
expiresAtRequired

Continuation expiry.

string · date-time
Full definition
{
  "type": "string",
  "description": "Continuation expiry.",
  "format": "date-time",
  "example": "2026-12-31T18:00:00.000Z"
}
reentryContextOptional

Optional non-reading recovery target for this same original contact and scope. It grants no portal, inbox or push access.

allOf
Full definition
{
  "description": "Optional non-reading recovery target for this same original contact and scope. It grants no portal, inbox or push access.",
  "allOf": [
    {
      "$ref": "#/components/schemas/GuestPortalReentryContextDto"
    }
  ],
  "example": {
    "hint": "gpr1_synthetic_recovery_context_example_not_a_runtime_credential_0000000000",
    "expiresAt": "2026-12-31T18:00:00.000Z"
  }
}
Full definition
{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "description": "New short-lived Guest Portal continuation; retain privately in the portal session only.",
      "readOnly": true,
      "example": "synthetic-example-credential"
    },
    "expiresAt": {
      "type": "string",
      "description": "Continuation expiry.",
      "format": "date-time",
      "example": "2026-12-31T18:00:00.000Z"
    },
    "reentryContext": {
      "description": "Optional non-reading recovery target for this same original contact and scope. It grants no portal, inbox or push access.",
      "allOf": [
        {
          "$ref": "#/components/schemas/GuestPortalReentryContextDto"
        }
      ],
      "example": {
        "hint": "gpr1_synthetic_recovery_context_example_not_a_runtime_credential_0000000000",
        "expiresAt": "2026-12-31T18:00:00.000Z"
      }
    }
  },
  "description": "New private Guest Portal continuation after atomic one-time verification.",
  "required": [
    "token",
    "expiresAt"
  ],
  "example": {
    "token": "synthetic-example-credential",
    "expiresAt": "2026-12-31T18:00:00.000Z"
  }
}
GuestPortalReentryContextDto

Non-reading recovery context for the original existing guest contact and portal scope. An unverified candidate still requires successful OTP confirmation. The context permits only the targeted reentry workflow, never portal, inbox or push access.

hintRequired

Opaque authenticated recovery hint. Store only as a recovery target; it is not a Guest Portal continuation or a push grant.

string
Full definition
{
  "type": "string",
  "description": "Opaque authenticated recovery hint. Store only as a recovery target; it is not a Guest Portal continuation or a push grant.",
  "minLength": 64,
  "maxLength": 2048,
  "pattern": "^gpr1_[A-Za-z0-9_-]+$",
  "example": "gpr1_synthetic_recovery_context_example_not_a_runtime_credential_0000000000",
  "readOnly": true
}
expiresAtRequired

Absolute recovery-target expiry. Current guest, original contact and portal scope remain authoritative before every code request and confirmation.

string · date-time
Full definition
{
  "type": "string",
  "description": "Absolute recovery-target expiry. Current guest, original contact and portal scope remain authoritative before every code request and confirmation.",
  "format": "date-time",
  "readOnly": true,
  "example": "2026-12-31T18:00:00.000Z"
}
Full definition
{
  "type": "object",
  "properties": {
    "hint": {
      "type": "string",
      "description": "Opaque authenticated recovery hint. Store only as a recovery target; it is not a Guest Portal continuation or a push grant.",
      "minLength": 64,
      "maxLength": 2048,
      "pattern": "^gpr1_[A-Za-z0-9_-]+$",
      "example": "gpr1_synthetic_recovery_context_example_not_a_runtime_credential_0000000000",
      "readOnly": true
    },
    "expiresAt": {
      "type": "string",
      "description": "Absolute recovery-target expiry. Current guest, original contact and portal scope remain authoritative before every code request and confirmation.",
      "format": "date-time",
      "readOnly": true,
      "example": "2026-12-31T18:00:00.000Z"
    }
  },
  "description": "Non-reading recovery context for the original existing guest contact and portal scope. An unverified candidate still requires successful OTP confirmation. The context permits only the targeted reentry workflow, never portal, inbox or push access.",
  "required": [
    "hint",
    "expiresAt"
  ],
  "example": {
    "hint": "gpr1_synthetic_recovery_context_example_not_a_runtime_credential_0000000000",
    "expiresAt": "2026-12-31T18:00:00.000Z"
  }
}
TranslatedErrorDto

Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.

statusCodeRequired

HTTP status code repeated from the response.

integer
Full definition
{
  "type": "integer",
  "description": "HTTP status code repeated from the response.",
  "example": 400
}
errorRequired

Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.

string
Full definition
{
  "type": "string",
  "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
  "example": "errors.request.invalid"
}
codeRequired

Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.

string
Full definition
{
  "type": "string",
  "example": "HTTP_BAD_REQUEST",
  "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
}
messageRequired

Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
}
translationKeyRequired

Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
validationErrorsOptional

Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.

array
Full definition
{
  "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
  "type": "array",
  "items": {
    "$ref": "#/components/schemas/ValidationErrorDto"
  },
  "example": [
    {
      "field": "email",
      "translationKey": "validation:isEmail",
      "code": "isEmail",
      "message": "validation:isEmail"
    }
  ]
}
detailsOptional

Optional domain-specific blocker or validation details

oneOf
Full definition
{
  "description": "Optional domain-specific blocker or validation details",
  "oneOf": [
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "example": [
    "example"
  ]
}
Full definition
{
  "type": "object",
  "properties": {
    "statusCode": {
      "type": "integer",
      "description": "HTTP status code repeated from the response.",
      "example": 400
    },
    "error": {
      "type": "string",
      "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
      "example": "errors.request.invalid"
    },
    "code": {
      "type": "string",
      "example": "HTTP_BAD_REQUEST",
      "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
    },
    "message": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
    },
    "translationKey": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    },
    "validationErrors": {
      "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/ValidationErrorDto"
      },
      "example": [
        {
          "field": "email",
          "translationKey": "validation:isEmail",
          "code": "isEmail",
          "message": "validation:isEmail"
        }
      ]
    },
    "details": {
      "description": "Optional domain-specific blocker or validation details",
      "oneOf": [
        {
          "type": "array",
          "items": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": [
            "example"
          ]
        },
        {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": {
            "exampleKey": "example"
          }
        }
      ],
      "example": [
        "example"
      ]
    }
  },
  "required": [
    "statusCode",
    "error",
    "code",
    "message",
    "translationKey"
  ],
  "description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
  "example": {
    "statusCode": 400,
    "error": "errors:http.badRequest",
    "code": "HTTP_BAD_REQUEST",
    "message": "errors:http.badRequest",
    "translationKey": "errors:http.badRequest"
  }
}
ValidationErrorDto

Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.

fieldRequired

Public field path. Nested properties and array indices are separated by dots.

string
Full definition
{
  "type": "string",
  "example": "email",
  "description": "Public field path. Nested properties and array indices are separated by dots."
}
translationKeyRequired

Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
}
codeRequired

Stable validator identifier for this field failure. Custom validators may define additional identifiers.

string
Full definition
{
  "type": "string",
  "example": "isEmail",
  "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
}
messageRequired

Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
Full definition
{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "example": "email",
      "description": "Public field path. Nested properties and array indices are separated by dots."
    },
    "translationKey": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
    },
    "code": {
      "type": "string",
      "example": "isEmail",
      "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
    },
    "message": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    }
  },
  "required": [
    "field",
    "translationKey",
    "code",
    "message"
  ],
  "description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
  "example": {
    "field": "email",
    "translationKey": "validation:isEmail",
    "code": "isEmail",
    "message": "validation:isEmail"
  }
}
JsonValue

Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.

Full definition
{
  "oneOf": [
    {
      "type": "string",
      "nullable": true,
      "example": "example"
    },
    {
      "type": "number",
      "example": 0
    },
    {
      "type": "boolean",
      "example": true
    },
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
  "example": "example"
}

Hallify uses essential cookies and optional analytics.

Essential cookies keep sign-in, locale, and theme preferences working. Analytics is off until you choose to allow it.