API reference
Creator-enabled bootstrap
Initializes1–30 ticket types only for an empty campaign with creator-enabled bootstrap, using a durable idempotent operation.
https://api.sparkglim.net/api/white-label/v1/ticket-types/bootstrapAccess model
- Access model
- Server-side Organization HMAC
- Required scope
tickets:write- Documented availability
- Implemented in source
Availability is verified from source, not a live production guarantee.
Private signing stays on your server. API Version 1 uses signature format v2; it is not API v2.
Headers
| Name | Type | Validation |
|---|---|---|
x-white-label-domainRequiredVerified website hostname used to resolve the approved organization account and bind this request. | string | Validation: verified HTTPS hostname. |
x-white-label-key-idRequiredIdentifier extracted from the single issued Private Key value; never send its secret in this header. | string | Validation: issued private key internal identifier. |
x-white-label-signature-versionRequiredSelects the domain-bound signing format; API routes remain Version 1. | string | Validation: 2. |
x-white-label-timestampRequiredRequest signing time in milliseconds, checked against the server clock to reject stale requests. | string | Validation: 13 digit milliseconds; within five minutes. |
x-white-label-nonceRequiredFresh random signing value recorded by the server to reject replay of a signed request. | string | Validation: fresh 16–128 [A-Za-z0-9_-]. |
x-white-label-signatureRequiredHMAC-SHA256 of the canonical domain, idempotency key, campaign credential, timestamp, nonce, method, path, sorted query and exact body hash. | string | Validation: lowercase hexadecimal HMAC-SHA256. |
x-white-label-campaign-keyOptionalOptional complete Campaign Key that narrows a private request to the same authorized campaign. | string | Validation: complete optional scoped keyId:secret. |
X-Idempotency-KeyRequiredStable business-operation identity reused on retries with unchanged request details; different details under the same key are rejected. | string | Validation: 16–128 [A-Za-z0-9_-]. |
Request
| Name | Type | Validation |
|---|---|---|
campaignIdRequiredExisting campaign record within the caller’s account and any narrower campaign credential. | string | Validation: UUID. |
ticketTypesRequiredInitial ticket definitions for an empty creator-enabled campaign; each item uses the ticket schema without campaignId. | object[] | Validation: 1–30 ticket definitions; all create ticket fields except campaignId. |
Request
Examples describe the contract and are not executed. Use authorized test records; never paste a real secret into these pages.
POST /api/white-label/v1/ticket-types/bootstrap HTTP/1.1
Host: api.sparkglim.net
x-white-label-domain: events.example.com
x-white-label-key-id: <ISSUED_KEY_ID>
x-white-label-signature-version: 2
x-white-label-timestamp: <FRESH_MILLISECONDS>
x-white-label-nonce: <FRESH_SIGNING_NONCE>
x-white-label-signature: <SERVER_GENERATED_SIGNATURE>
X-Idempotency-Key: example_stable_operation_0001
Content-Type: application/json
{
"campaignId": "11111111-1111-4111-8111-111111111111",
"ticketTypes": [
{
"name": "Example ticket",
"price": 10,
"quantity_available": 100
}
]
}Response
{
"success": true,
"data": {
"id": "11111111-1111-4111-8111-111111111111",
"status": "pending"
},
"requestId": "wlapi_example"
}{
"success": false,
"error": "<ERROR_MESSAGE>",
"requestId": "wlapi_example"
}Validation, permissions, unavailable records and temporary service failures use the handler’s HTTP status and error payload.
Limits & retries
Organization limiter: 120 requests per key and 300 per IP per window; honor Retry-After and X-RateLimit headers.
Source compatibility
Authorized operations require account-specific testing.
server/src/api/router.tsserver/src/api/routes/white-label.tsserver/src/white-label/auth.tsserver/src/white-label/schemas.tsserver/src/white-label/organization-service.tsserver/src/white-label/service.ts