Skip to content
Sections

Guest portal

Read current QR history consent and statement

GET/guest-portal/qr-visits/{associationId}/consent

Current Portal ownership is sufficient to inspect consent or withdraw it, including after native retirement. Private order history separately requires current contact assurance.

Authentication

x-guest-portal-token: <HALLIFY_GUEST_PORTAL_TOKEN>

Guest-owned portal session token.

Connection guide

Parameters

associationIdPath · Required

Immutable original QR association owned by the authenticated Portal subject.

string · uuid
Full definition
{
  "format": "uuid",
  "type": "string",
  "example": "9b6163a8-afea-4877-818b-8e2ae28a2845"
}
localeQuery · Optional

Consent statement language.

string
Full definition
{
  "default": "en",
  "type": "string",
  "enum": [
    "en",
    "ka",
    "ru"
  ],
  "example": "en"
}

Responses

200Latest append-only decision, permanent security stop and current localized statement.
GuestPortalQrConsentResultDto
Full definition
{
  "$ref": "#/components/schemas/GuestPortalQrConsentResultDto"
}
Example response · 200 · application/json
{
  "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
  "hardRevoked": true,
  "currentDecision": {
    "id": "f2b32ae6-a690-4986-87f0-853fb21736b7",
    "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
    "revision": 1,
    "decision": "ACCEPT",
    "createdAt": "2026-01-15T10:00:00.000Z"
  },
  "statement": {
    "purpose": "QR_HISTORY_ASSOCIATION",
    "termsVersion": "example",
    "termsDigest": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
    "locale": "en",
    "text": "example"
  }
}
400Malformed input, changed statement, or invalid target proof/OTP. Wrong OTP attempts are committed.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 400 · application/json
{
  "statusCode": 400,
  "error": "errors:http.badRequest",
  "code": "HTTP_BAD_REQUEST",
  "message": "errors:http.badRequest",
  "translationKey": "errors:http.badRequest"
}
401The original QR bearer/actual Origin or current Portal session is unavailable.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 401 · application/json
{
  "statusCode": 401,
  "error": "errors:http.unauthorized",
  "code": "HTTP_UNAUTHORIZED",
  "message": "errors:http.unauthorized",
  "translationKey": "errors:http.unauthorized"
}
403Private history needs current contact assurance. Consent withdrawal does not need fresh OTP.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 403 · application/json
{
  "statusCode": 403,
  "error": "errors:http.forbidden",
  "code": "HTTP_FORBIDDEN",
  "message": "errors:http.forbidden",
  "translationKey": "errors:http.forbidden"
}
404The exact owned association or eligible original request is unavailable.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 404 · application/json
{
  "statusCode": 404,
  "error": "errors:http.notFound",
  "code": "HTTP_NOT_FOUND",
  "message": "errors:http.notFound",
  "translationKey": "errors:http.notFound"
}
429The canonical contact-verification attempt budget is exhausted.

Response headers

Retry-After

Whole seconds the client must wait before retrying the rejected request.

integer
Full definition
{
  "type": "integer",
  "minimum": 1,
  "example": 60
}
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 429 · application/json
{
  "statusCode": 429,
  "error": "errors:http.tooManyRequests",
  "code": "HTTP_TOO_MANY_REQUESTS",
  "message": "errors:http.tooManyRequests",
  "translationKey": "errors:http.tooManyRequests"
}
503Protected-data policy or command encryption keys are unavailable.
TranslatedErrorDto
Full definition
{
  "$ref": "#/components/schemas/TranslatedErrorDto"
}
Example response · 503 · application/json
{
  "statusCode": 503,
  "error": "errors:http.serviceUnavailable",
  "code": "HTTP_SERVICE_UNAVAILABLE",
  "message": "errors:http.serviceUnavailable",
  "translationKey": "errors:http.serviceUnavailable"
}

Schemas

GuestPortalQrConsentResultDto

Current consent decision, permanent security stop and localized statement for an owned association.

associationIdRequired

Original association owned by the current Portal subject.

string · uuid
Full definition
{
  "type": "string",
  "format": "uuid",
  "description": "Original association owned by the current Portal subject.",
  "example": "f73e02c0-4bf2-405f-88b4-ed9700c5f631"
}
hardRevokedRequired

Permanent security stop; reconsent cannot restore history.

boolean
Full definition
{
  "type": "boolean",
  "description": "Permanent security stop; reconsent cannot restore history.",
  "example": true
}
currentDecisionRequired

Immutable original consent command acknowledgement, independent of later decisions.

object
Full definition
{
  "type": "object",
  "description": "Immutable original consent command acknowledgement, independent of later decisions.",
  "additionalProperties": false,
  "required": [
    "id",
    "associationId",
    "revision",
    "decision",
    "createdAt"
  ],
  "properties": {
    "id": {
      "type": "string",
      "format": "uuid",
      "description": "Immutable consent command receipt UUID.",
      "example": "f2b32ae6-a690-4986-87f0-853fb21736b7"
    },
    "associationId": {
      "type": "string",
      "format": "uuid",
      "description": "Original immutable QR association.",
      "example": "f73e02c0-4bf2-405f-88b4-ed9700c5f631"
    },
    "revision": {
      "type": "integer",
      "minimum": 1,
      "description": "Append-only consent revision.",
      "example": 1
    },
    "decision": {
      "type": "string",
      "enum": [
        "ACCEPT",
        "WITHDRAW"
      ],
      "description": "Decision recorded by this command, which can differ from a later current decision.",
      "example": "ACCEPT"
    },
    "createdAt": {
      "type": "string",
      "format": "date-time",
      "description": "Original decision timestamp.",
      "example": "2026-01-15T10:00:00.000Z"
    }
  },
  "example": {
    "id": "f2b32ae6-a690-4986-87f0-853fb21736b7",
    "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
    "revision": 1,
    "decision": "ACCEPT",
    "createdAt": "2026-01-15T10:00:00.000Z"
  }
}
statementRequired

Exact server-owned localized statement for explicit QR history consent.

object
Full definition
{
  "type": "object",
  "description": "Exact server-owned localized statement for explicit QR history consent.",
  "additionalProperties": false,
  "required": [
    "purpose",
    "termsVersion",
    "termsDigest",
    "locale",
    "text"
  ],
  "properties": {
    "purpose": {
      "type": "string",
      "enum": [
        "QR_HISTORY_ASSOCIATION"
      ],
      "description": "Consent limited to the associated original QR history.",
      "example": "QR_HISTORY_ASSOCIATION"
    },
    "termsVersion": {
      "type": "string",
      "maxLength": 64,
      "description": "Server-owned statement version.",
      "example": "example"
    },
    "termsDigest": {
      "type": "string",
      "pattern": "^[a-f0-9]{64}$",
      "description": "Canonical statement digest bound into the target proof.",
      "example": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
    },
    "locale": {
      "type": "string",
      "enum": [
        "en",
        "ka",
        "ru"
      ],
      "description": "Language shown to the guest.",
      "example": "en"
    },
    "text": {
      "type": "string",
      "description": "Exact statement text the guest accepts.",
      "example": "example"
    }
  },
  "example": {
    "purpose": "QR_HISTORY_ASSOCIATION",
    "termsVersion": "example",
    "termsDigest": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
    "locale": "en",
    "text": "example"
  }
}
Full definition
{
  "type": "object",
  "description": "Current consent decision, permanent security stop and localized statement for an owned association.",
  "additionalProperties": false,
  "required": [
    "associationId",
    "hardRevoked",
    "currentDecision",
    "statement"
  ],
  "properties": {
    "associationId": {
      "type": "string",
      "format": "uuid",
      "description": "Original association owned by the current Portal subject.",
      "example": "f73e02c0-4bf2-405f-88b4-ed9700c5f631"
    },
    "hardRevoked": {
      "type": "boolean",
      "description": "Permanent security stop; reconsent cannot restore history.",
      "example": true
    },
    "currentDecision": {
      "type": "object",
      "description": "Immutable original consent command acknowledgement, independent of later decisions.",
      "additionalProperties": false,
      "required": [
        "id",
        "associationId",
        "revision",
        "decision",
        "createdAt"
      ],
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid",
          "description": "Immutable consent command receipt UUID.",
          "example": "f2b32ae6-a690-4986-87f0-853fb21736b7"
        },
        "associationId": {
          "type": "string",
          "format": "uuid",
          "description": "Original immutable QR association.",
          "example": "f73e02c0-4bf2-405f-88b4-ed9700c5f631"
        },
        "revision": {
          "type": "integer",
          "minimum": 1,
          "description": "Append-only consent revision.",
          "example": 1
        },
        "decision": {
          "type": "string",
          "enum": [
            "ACCEPT",
            "WITHDRAW"
          ],
          "description": "Decision recorded by this command, which can differ from a later current decision.",
          "example": "ACCEPT"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time",
          "description": "Original decision timestamp.",
          "example": "2026-01-15T10:00:00.000Z"
        }
      },
      "example": {
        "id": "f2b32ae6-a690-4986-87f0-853fb21736b7",
        "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
        "revision": 1,
        "decision": "ACCEPT",
        "createdAt": "2026-01-15T10:00:00.000Z"
      }
    },
    "statement": {
      "type": "object",
      "description": "Exact server-owned localized statement for explicit QR history consent.",
      "additionalProperties": false,
      "required": [
        "purpose",
        "termsVersion",
        "termsDigest",
        "locale",
        "text"
      ],
      "properties": {
        "purpose": {
          "type": "string",
          "enum": [
            "QR_HISTORY_ASSOCIATION"
          ],
          "description": "Consent limited to the associated original QR history.",
          "example": "QR_HISTORY_ASSOCIATION"
        },
        "termsVersion": {
          "type": "string",
          "maxLength": 64,
          "description": "Server-owned statement version.",
          "example": "example"
        },
        "termsDigest": {
          "type": "string",
          "pattern": "^[a-f0-9]{64}$",
          "description": "Canonical statement digest bound into the target proof.",
          "example": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
        },
        "locale": {
          "type": "string",
          "enum": [
            "en",
            "ka",
            "ru"
          ],
          "description": "Language shown to the guest.",
          "example": "en"
        },
        "text": {
          "type": "string",
          "description": "Exact statement text the guest accepts.",
          "example": "example"
        }
      },
      "example": {
        "purpose": "QR_HISTORY_ASSOCIATION",
        "termsVersion": "example",
        "termsDigest": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
        "locale": "en",
        "text": "example"
      }
    }
  },
  "example": {
    "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
    "hardRevoked": true,
    "currentDecision": {
      "id": "f2b32ae6-a690-4986-87f0-853fb21736b7",
      "associationId": "f73e02c0-4bf2-405f-88b4-ed9700c5f631",
      "revision": 1,
      "decision": "ACCEPT",
      "createdAt": "2026-01-15T10:00:00.000Z"
    },
    "statement": {
      "purpose": "QR_HISTORY_ASSOCIATION",
      "termsVersion": "example",
      "termsDigest": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
      "locale": "en",
      "text": "example"
    }
  }
}
TranslatedErrorDto

Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.

statusCodeRequired

HTTP status code repeated from the response.

integer
Full definition
{
  "type": "integer",
  "description": "HTTP status code repeated from the response.",
  "example": 400
}
errorRequired

Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.

string
Full definition
{
  "type": "string",
  "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
  "example": "errors.request.invalid"
}
codeRequired

Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions.

string
Full definition
{
  "type": "string",
  "example": "HTTP_BAD_REQUEST",
  "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
}
messageRequired

Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
}
translationKeyRequired

Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback.

string
Full definition
{
  "type": "string",
  "example": "errors:http.badRequest",
  "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
validationErrorsOptional

Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.

array
Full definition
{
  "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
  "type": "array",
  "items": {
    "$ref": "#/components/schemas/ValidationErrorDto"
  },
  "example": [
    {
      "field": "email",
      "translationKey": "validation:isEmail",
      "code": "isEmail",
      "message": "validation:isEmail"
    }
  ]
}
detailsOptional

Optional domain-specific blocker or validation details

oneOf
Full definition
{
  "description": "Optional domain-specific blocker or validation details",
  "oneOf": [
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "example": [
    "example"
  ]
}
Full definition
{
  "type": "object",
  "properties": {
    "statusCode": {
      "type": "integer",
      "description": "HTTP status code repeated from the response.",
      "example": 400
    },
    "error": {
      "type": "string",
      "description": "Translation key for the HTTP category, such as errors:http.conflict. The specific cause is identified by code and translationKey.",
      "example": "errors.request.invalid"
    },
    "code": {
      "type": "string",
      "example": "HTTP_BAD_REQUEST",
      "description": "Stable machine-readable domain code, or an HTTP_* fallback when no domain code is provided. Branch on this field and the HTTP status; localized wording never controls retries or business decisions."
    },
    "message": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Translation key, identical to translationKey. The API does not return localized display text. Resolve the key and translationValues in the consuming application."
    },
    "translationKey": {
      "type": "string",
      "example": "errors:http.badRequest",
      "description": "Canonical translation key, identical to message. Status-specific errors:http.* keys cover unspecified failures. Public keys and EN/RU explanations are listed in Developers; unknown keys require a localized client fallback."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    },
    "validationErrors": {
      "description": "Field validation failures with translation keys and stable validator codes. Submitted values and raw validator text are not included.",
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/ValidationErrorDto"
      },
      "example": [
        {
          "field": "email",
          "translationKey": "validation:isEmail",
          "code": "isEmail",
          "message": "validation:isEmail"
        }
      ]
    },
    "details": {
      "description": "Optional domain-specific blocker or validation details",
      "oneOf": [
        {
          "type": "array",
          "items": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": [
            "example"
          ]
        },
        {
          "type": "object",
          "additionalProperties": {
            "$ref": "#/components/schemas/JsonValue"
          },
          "example": {
            "exampleKey": "example"
          }
        }
      ],
      "example": [
        "example"
      ]
    }
  },
  "required": [
    "statusCode",
    "error",
    "code",
    "message",
    "translationKey"
  ],
  "description": "Stable error envelope emitted by the global HTTP exception boundary. Domain-specific machine data, when present, is nested under details.",
  "example": {
    "statusCode": 400,
    "error": "errors:http.badRequest",
    "code": "HTTP_BAD_REQUEST",
    "message": "errors:http.badRequest",
    "translationKey": "errors:http.badRequest"
  }
}
ValidationErrorDto

Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.

fieldRequired

Public field path. Nested properties and array indices are separated by dots.

string
Full definition
{
  "type": "string",
  "example": "email",
  "description": "Public field path. Nested properties and array indices are separated by dots."
}
translationKeyRequired

Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
}
codeRequired

Stable validator identifier for this field failure. Custom validators may define additional identifiers.

string
Full definition
{
  "type": "string",
  "example": "isEmail",
  "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
}
messageRequired

Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included.

string
Full definition
{
  "type": "string",
  "example": "validation:isEmail",
  "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
}
translationValuesOptional

Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.

object
Full definition
{
  "type": "object",
  "additionalProperties": {
    "oneOf": [
      {
        "type": "string",
        "example": "example"
      },
      {
        "type": "number",
        "example": 0
      },
      {
        "type": "boolean",
        "example": true
      }
    ],
    "example": "example"
  },
  "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
  "example": {
    "exampleKey": "example"
  }
}
Full definition
{
  "type": "object",
  "properties": {
    "field": {
      "type": "string",
      "example": "email",
      "description": "Public field path. Nested properties and array indices are separated by dots."
    },
    "translationKey": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key for this validator, identical to message. Resolve it using a client dictionary; see the public Developers error catalog."
    },
    "code": {
      "type": "string",
      "example": "isEmail",
      "description": "Stable validator identifier for this field failure. Custom validators may define additional identifiers."
    },
    "message": {
      "type": "string",
      "example": "validation:isEmail",
      "description": "Translation key describing this field validation failure, identical to translationKey. Submitted values and validator prose are not included."
    },
    "translationValues": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "example": "example"
          },
          {
            "type": "number",
            "example": 0
          },
          {
            "type": "boolean",
            "example": true
          }
        ],
        "example": "example"
      },
      "description": "Optional scalar values for placeholders in the translation. Treat values as data, escape them when rendering, and never use them as translation options.",
      "example": {
        "exampleKey": "example"
      }
    }
  },
  "required": [
    "field",
    "translationKey",
    "code",
    "message"
  ],
  "description": "Field validation failure with a field path, stable validator code and a translation key. Human-readable text belongs to the consuming application.",
  "example": {
    "field": "email",
    "translationKey": "validation:isEmail",
    "code": "isEmail",
    "message": "validation:isEmail"
  }
}
JsonValue

Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.

Full definition
{
  "oneOf": [
    {
      "type": "string",
      "nullable": true,
      "example": "example"
    },
    {
      "type": "number",
      "example": 0
    },
    {
      "type": "boolean",
      "example": true
    },
    {
      "type": "array",
      "items": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": [
        "example"
      ]
    },
    {
      "type": "object",
      "additionalProperties": {
        "$ref": "#/components/schemas/JsonValue"
      },
      "example": {
        "exampleKey": "example"
      }
    }
  ],
  "description": "Recursively JSON-safe value used only where the owning contract intentionally allows free-form structured data.",
  "example": "example"
}

Hallify uses essential cookies and optional analytics.

Essential cookies keep sign-in, locale, and theme preferences working. Analytics is off until you choose to allow it.