Authentication
x-guest-portal-token: <HALLIFY_GUEST_PORTAL_TOKEN>Guest-owned portal session token.
Parameters
associationIdPath · RequiredImmutable original QR association owned by the authenticated Portal subject.
string · uuidFull definition
{ "format": "uuid", "type": "string", "example": "9b6163a8-afea-4877-818b-8e2ae28a2845" }idempotency-keyHeader · RequiredRequired idempotency key, up to 128 characters
stringFull definition
{ "type": "string", "minLength": 1, "maxLength": 128, "example": "example" }
Request body
Required
New explicit server-statement acceptance and current verified contact.
application/json
Full definition
{
"$ref": "#/components/schemas/PrepareGuestPortalQrBookingProofDto"
}Responses
200Prepared isolated BOOKING target proof.
Full definition
{
"$ref": "#/components/schemas/GuestPortalQrTargetProofResultDto"
}{
"proofId": "6eeca0df-6b25-4279-8845-acecc5a1976c",
"verificationId": null,
"portalSessionId": "133fe1a2-9859-4d88-81a0-17809a2f73aa",
"expiresAt": "2026-12-31T18:00:00.000Z",
"state": "PREPARED"
}400Malformed input, changed statement, or invalid target proof/OTP. Wrong OTP attempts are committed.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 400,
"error": "errors:http.badRequest",
"code": "HTTP_BAD_REQUEST",
"message": "errors:http.badRequest",
"translationKey": "errors:http.badRequest"
}401The original QR bearer/actual Origin or current Portal session is unavailable.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 401,
"error": "errors:http.unauthorized",
"code": "HTTP_UNAUTHORIZED",
"message": "errors:http.unauthorized",
"translationKey": "errors:http.unauthorized"
}403Private history needs current contact assurance. Consent withdrawal does not need fresh OTP.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 403,
"error": "errors:http.forbidden",
"code": "HTTP_FORBIDDEN",
"message": "errors:http.forbidden",
"translationKey": "errors:http.forbidden"
}404The exact owned association or eligible original request is unavailable.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 404,
"error": "errors:http.notFound",
"code": "HTTP_NOT_FOUND",
"message": "errors:http.notFound",
"translationKey": "errors:http.notFound"
}409Idempotency conflict or documented operation-specific domain conflict
Full definition
{
"$ref": "#/components/schemas/GuestPortalQrCommandConflictDto"
}{
"statusCode": 409,
"error": "errors:http.conflict",
"code": "TABLE_PUBLIC_REVISION_CONFLICT",
"message": "errors:http.conflict",
"translationKey": "errors:http.conflict"
}429The canonical contact-verification attempt budget is exhausted.
Response headers
Retry-AfterWhole seconds the client must wait before retrying the rejected request.
integerFull definition
{
"type": "integer",
"minimum": 1,
"example": 60
}Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 429,
"error": "errors:http.tooManyRequests",
"code": "HTTP_TOO_MANY_REQUESTS",
"message": "errors:http.tooManyRequests",
"translationKey": "errors:http.tooManyRequests"
}503Protected-data policy or command encryption keys are unavailable.
Full definition
{
"$ref": "#/components/schemas/TranslatedErrorDto"
}{
"statusCode": 503,
"error": "errors:http.serviceUnavailable",
"code": "HTTP_SERVICE_UNAVAILABLE",
"message": "errors:http.serviceUnavailable",
"translationKey": "errors:http.serviceUnavailable"
}Schemas
PrepareGuestPortalQrBookingProofDto
Isolated BOOKING contact challenge for one frozen QR association or reconsent target.
commandIdRequiredClient-generated command UUID retained across exact retries and the resulting immutable consent receipt.
string · uuidFull definition
{ "type": "string", "format": "uuid", "description": "Client-generated command UUID retained across exact retries and the resulting immutable consent receipt.", "example": "3e4a6887-ce11-4ae4-8708-9bed02386776" }expectedRevisionRequiredCurrent association consent revision; zero only for the first native association.
integerFull definition
{ "type": "integer", "minimum": 0, "maximum": 2147483646, "description": "Current association consent revision; zero only for the first native association.", "example": 1 }localeRequiredLocale of the exact server-owned consent statement shown to the guest.
stringFull definition
{ "type": "string", "enum": [ "en", "ka", "ru" ], "description": "Locale of the exact server-owned consent statement shown to the guest.", "example": "en" }termsVersionRequiredServer-issued statement version from the statement or current consent response.
stringFull definition
{ "type": "string", "minLength": 1, "maxLength": 64, "description": "Server-issued statement version from the statement or current consent response.", "example": "example" }termsDigestRequiredServer-issued digest of the exact version, purpose, locale and statement text.
stringFull definition
{ "type": "string", "minLength": 64, "maxLength": 64, "pattern": "^[a-f0-9]{64}$", "description": "Server-issued digest of the exact version, purpose, locale and statement text.", "example": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef" }contactTypeRequiredContact kind verified by the canonical isolated BOOKING challenge.
stringFull definition
{ "type": "string", "enum": [ "EMAIL", "PHONE" ], "description": "Contact kind verified by the canonical isolated BOOKING challenge.", "example": "EMAIL" }contactRequiredContact to verify; an existing Portal session requires its current verified contact.
stringFull definition
{ "type": "string", "minLength": 1, "maxLength": 320, "description": "Contact to verify; an existing Portal session requires its current verified contact.", "example": "guest@example.test" }displayNameRequiredDisplay name for canonical contact verification without replacing existing identity data.
stringFull definition
{ "type": "string", "minLength": 1, "maxLength": 120, "description": "Display name for canonical contact verification without replacing existing identity data.", "example": "Example Guest" }
Full definition
{
"type": "object",
"properties": {
"commandId": {
"type": "string",
"format": "uuid",
"description": "Client-generated command UUID retained across exact retries and the resulting immutable consent receipt.",
"example": "3e4a6887-ce11-4ae4-8708-9bed02386776"
},
"expectedRevision": {
"type": "integer",
"minimum": 0,
"maximum": 2147483646,
"description": "Current association consent revision; zero only for the first native association.",
"example": 1
},
"locale": {
"type": "string",
"enum": [
"en",
"ka",
"ru"
],
"description": "Locale of the exact server-owned consent statement shown to the guest.",
"example": "en"
},
"termsVersion": {
"type": "string",
"minLength": 1,
"maxLength": 64,
"description": "Server-issued statement version from the statement or current consent response.",
"example": "example"
},
"termsDigest": {
"type": "string",
"minLength": 64,
"maxLength": 64,
"pattern": "^[a-f0-9]{64}$",
"description": "Server-issued digest of the exact version, purpose, locale and statement text.",
"example": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
},
"contactType": {
"type": "string",
"enum": [
"EMAIL",
"PHONE"
],
"description": "Contact kind verified by the canonical isolated BOOKING challenge.",
"example": "EMAIL"
},
"contact": {
"type": "string",
"minLength": 1,
"maxLength": 320,
"description": "Contact to verify; an existing Portal session requires its current verified contact.",
"example": "guest@example.test"
},
"displayName": {
"type": "string",
"minLength": 1,
"maxLength": 120,
"description": "Display name for canonical contact verification without replacing existing identity data.",
"example": "Example Guest"
}
},
"required": [
"commandId",
"expectedRevision",
"locale",
"termsVersion",
"termsDigest",
"contactType",
"contact",
"displayName"
],
"description": "Isolated BOOKING contact challenge for one frozen QR association or reconsent target.",
"example": {
"commandId": "3e4a6887-ce11-4ae4-8708-9bed02386776",
"expectedRevision": 1,
"locale": "en",
"termsVersion": "example",
"termsDigest": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
"contactType": "EMAIL",
"contact": "guest@example.test",
"displayName": "Example Guest"
}
}GuestPortalQrTargetProofResultDto
Purpose-bound contact proof for one original QR association and consent command.
proofIdRequiredServer-selected target proof UUID.
string · uuidFull definition
{ "type": "string", "format": "uuid", "description": "Server-selected target proof UUID.", "example": "6eeca0df-6b25-4279-8845-acecc5a1976c" }verificationIdRequiredServer-selected isolated BOOKING challenge; null for reentry.
string · uuid · nullFull definition
{ "type": "string", "format": "uuid", "nullable": true, "description": "Server-selected isolated BOOKING challenge; null for reentry.", "example": "904a18d4-c890-4387-8e14-bc52c879c7ff" }portalSessionIdRequiredExisting Portal session or the exact reserved continuation session for first verification.
string · uuidFull definition
{ "type": "string", "format": "uuid", "description": "Existing Portal session or the exact reserved continuation session for first verification.", "example": "133fe1a2-9859-4d88-81a0-17809a2f73aa" }expiresAtRequiredBounded proof deadline; no native authority is extended.
string · date-timeFull definition
{ "type": "string", "format": "date-time", "description": "Bounded proof deadline; no native authority is extended.", "example": "2026-12-31T18:00:00.000Z" }stateRequiredPrepared BOOKING or verified reentry proof state.
stringFull definition
{ "type": "string", "enum": [ "PREPARED", "VERIFIED" ], "description": "Prepared BOOKING or verified reentry proof state.", "example": "PREPARED" }testCodeOptionalCanonical verification test-mode code when that native mode is enabled.
stringFull definition
{ "type": "string", "pattern": "^\\d{6}$", "description": "Canonical verification test-mode code when that native mode is enabled.", "example": "000001" }
Full definition
{
"type": "object",
"description": "Purpose-bound contact proof for one original QR association and consent command.",
"additionalProperties": false,
"required": [
"proofId",
"verificationId",
"portalSessionId",
"expiresAt",
"state"
],
"properties": {
"proofId": {
"type": "string",
"format": "uuid",
"description": "Server-selected target proof UUID.",
"example": "6eeca0df-6b25-4279-8845-acecc5a1976c"
},
"verificationId": {
"type": "string",
"format": "uuid",
"nullable": true,
"description": "Server-selected isolated BOOKING challenge; null for reentry.",
"example": "904a18d4-c890-4387-8e14-bc52c879c7ff"
},
"portalSessionId": {
"type": "string",
"format": "uuid",
"description": "Existing Portal session or the exact reserved continuation session for first verification.",
"example": "133fe1a2-9859-4d88-81a0-17809a2f73aa"
},
"expiresAt": {
"type": "string",
"format": "date-time",
"description": "Bounded proof deadline; no native authority is extended.",
"example": "2026-12-31T18:00:00.000Z"
},
"state": {
"type": "string",
"enum": [
"PREPARED",
"VERIFIED"
],
"description": "Prepared BOOKING or verified reentry proof state.",
"example": "PREPARED"
},
"testCode": {
"type": "string",
"pattern": "^\\d{6}$",
"description": "Canonical verification test-mode code when that native mode is enabled.",
"example": "000001"
}
},
"example": {
"proofId": "6eeca0df-6b25-4279-8845-acecc5a1976c",
"verificationId": null,
"portalSessionId": "133fe1a2-9859-4d88-81a0-17809a2f73aa",
"expiresAt": "2026-12-31T18:00:00.000Z",
"state": "PREPARED"
}
}TranslatedErrorDto
Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.
statusCodeRequiredHTTP status code repeated from the response.
integerFull definition
{ "type": "integer", "description": "HTTP status code repeated from the response.", "example": 400 }errorRequiredTranslation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.
stringFull definition
{ "type": "string", "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.", "example": "errors.request.invalid" }codeRequiredStable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.
stringFull definition
{ "type": "string", "example": "HTTP_BAD_REQUEST", "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions." }messageRequiredTranslation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.
stringFull definition
{ "type": "string", "example": "errors:http.badRequest", "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application." }translationKeyRequiredCanonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.
stringFull definition
{ "type": "string", "example": "errors:http.badRequest", "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback." }translationValuesOptionalOptional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.
objectFull definition
{ "type": "object", "additionalProperties": { "oneOf": [ { "type": "string", "example": "example" }, { "type": "number", "example": 0 }, { "type": "boolean", "example": true } ], "example": "example" }, "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.", "example": { "exampleKey": "example" } }validationErrorsOptionalField validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.
arrayFull definition
{ "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.", "type": "array", "items": { "$ref": "#/components/schemas/ValidationErrorDto" }, "example": [ { "field": "email", "translationKey": "validation:isEmail", "code": "isEmail", "message": "validation:isEmail" } ] }detailsOptionalOptional domain-specific blocker or validation details
oneOfFull definition
{ "description": "Optional domain-specific blocker or validation details", "oneOf": [ { "type": "array", "items": { "$ref": "#/components/schemas/JsonValue" }, "example": [ "example" ] }, { "type": "object", "additionalProperties": { "$ref": "#/components/schemas/JsonValue" }, "example": { "exampleKey": "example" } } ], "example": [ "example" ] }
Full definition
{
"type": "object",
"properties": {
"statusCode": {
"type": "integer",
"description": "HTTP status code repeated from the response.",
"example": 400
},
"error": {
"type": "string",
"description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
"example": "errors.request.invalid"
},
"code": {
"type": "string",
"example": "HTTP_BAD_REQUEST",
"description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
},
"message": {
"type": "string",
"example": "errors:http.badRequest",
"description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
},
"translationKey": {
"type": "string",
"example": "errors:http.badRequest",
"description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
},
"translationValues": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"type": "string",
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
}
],
"example": "example"
},
"description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
"example": {
"exampleKey": "example"
}
},
"validationErrors": {
"description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
"type": "array",
"items": {
"$ref": "#/components/schemas/ValidationErrorDto"
},
"example": [
{
"field": "email",
"translationKey": "validation:isEmail",
"code": "isEmail",
"message": "validation:isEmail"
}
]
},
"details": {
"description": "Optional domain-specific blocker or validation details",
"oneOf": [
{
"type": "array",
"items": {
"$ref": "#/components/schemas/JsonValue"
},
"example": [
"example"
]
},
{
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/JsonValue"
},
"example": {
"exampleKey": "example"
}
}
],
"example": [
"example"
]
}
},
"required": [
"statusCode",
"error",
"code",
"message",
"translationKey"
],
"description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
"example": {
"statusCode": 400,
"error": "errors:http.badRequest",
"code": "HTTP_BAD_REQUEST",
"message": "errors:http.badRequest",
"translationKey": "errors:http.badRequest"
}
}ValidationErrorDto
Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.
fieldRequiredPublic field path. Nested properties and array indices are separated by dots.
stringFull definition
{ "type": "string", "example": "email", "description": "Public field path. Nested properties and array indices are separated by dots." }translationKeyRequiredTranslation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.
stringFull definition
{ "type": "string", "example": "validation:isEmail", "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog." }codeRequiredStable validator identifier for this field failure. Custom validators may define additional identifiers.
stringFull definition
{ "type": "string", "example": "isEmail", "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers." }messageRequiredTranslation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.
stringFull definition
{ "type": "string", "example": "validation:isEmail", "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included." }translationValuesOptionalOptional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.
objectFull definition
{ "type": "object", "additionalProperties": { "oneOf": [ { "type": "string", "example": "example" }, { "type": "number", "example": 0 }, { "type": "boolean", "example": true } ], "example": "example" }, "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.", "example": { "exampleKey": "example" } }
Full definition
{
"type": "object",
"properties": {
"field": {
"type": "string",
"example": "email",
"description": "Public field path. Nested properties and array indices are separated by dots."
},
"translationKey": {
"type": "string",
"example": "validation:isEmail",
"description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
},
"code": {
"type": "string",
"example": "isEmail",
"description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
},
"message": {
"type": "string",
"example": "validation:isEmail",
"description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
},
"translationValues": {
"type": "object",
"additionalProperties": {
"oneOf": [
{
"type": "string",
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
}
],
"example": "example"
},
"description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
"example": {
"exampleKey": "example"
}
}
},
"required": [
"field",
"translationKey",
"code",
"message"
],
"description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
"example": {
"field": "email",
"translationKey": "validation:isEmail",
"code": "isEmail",
"message": "validation:isEmail"
}
}JsonValue
Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.
Full definition
{
"oneOf": [
{
"type": "string",
"nullable": true,
"example": "example"
},
{
"type": "number",
"example": 0
},
{
"type": "boolean",
"example": true
},
{
"type": "array",
"items": {
"$ref": "#/components/schemas/JsonValue"
},
"example": [
"example"
]
},
{
"type": "object",
"additionalProperties": {
"$ref": "#/components/schemas/JsonValue"
},
"example": {
"exampleKey": "example"
}
}
],
"description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
"example": "example"
}GuestPortalQrCommandConflictDto
Changed command body or authorization, in-flight command, or stale append-only consent revision. Exact retries preserve the complete original command and key.
Full definition
{
"description": "Changed command body or authorization, in-flight command, or stale append-only consent revision. Exact retries preserve the complete original command and key.",
"example": {
"statusCode": 409,
"error": "errors:http.conflict",
"code": "TABLE_PUBLIC_REVISION_CONFLICT",
"message": "errors:http.conflict",
"translationKey": "errors:http.conflict"
},
"allOf": [
{
"$ref": "#/components/schemas/TranslatedErrorDto"
},
{
"type": "object",
"required": [
"code"
],
"properties": {
"statusCode": {
"type": "integer",
"enum": [
409
],
"description": "HTTP 409 conflict status.",
"example": 409
},
"code": {
"type": "string",
"enum": [
"IDEMPOTENCY_REQUEST_NOT_READY",
"IDEMPOTENCY_KEY_PAYLOAD_MISMATCH",
"IDEMPOTENCY_REQUEST_IN_PROGRESS",
"IDEMPOTENCY_SCOPE_INCOMPLETE",
"TABLE_PUBLIC_REVISION_CONFLICT",
"GUEST_PORTAL_QR_REVISION_CONFLICT"
],
"description": "Stable idempotency or operation-specific domain conflict code.",
"example": "IDEMPOTENCY_REQUEST_NOT_READY"
}
},
"example": {
"code": "IDEMPOTENCY_REQUEST_NOT_READY"
}
}
]
}