API reference

Start ticket purchase

Validates campaign ticket, quantity, required buyer details and browser protection, then returns the existing server checkout or free-ticket result.

POSThttps://api.sparkglim.net/api/public/tickets/purchase

Access model

Access model: Public access with validation
Documented availability: Implemented in source

Availability is verified from source, not a live production guarantee.

Open the returned checkout URL. SparkGlim Server owns prices, methods, payment verification and fulfillment; browser returns are navigation only.

Request

Name	Type	Validation
`campaign_id`Required Existing campaign record within the caller’s account and any narrower campaign credential.	`string`	Validation: UUID.
`ticket_id`Required The selected ticket type belonging to the specified campaign; server checks status, capacity and price.	`string`	Validation: UUID.
`quantity`Required Number of tickets requested; inventory and per-person purchase limits remain server-enforced.	`integer`	Validation: 1–100.
`phone_number`Required Participant contact phone; required payment channels and campaign rules may require a valid international number.	`string`	Validation: nonempty valid phone.
`email`Optional Contact email used by the configured campaign or account workflow; never a credential granting access by itself.	`string`	Validation: email.
`discount_code`Optional Existing campaign-specific discount or invitation credential, revalidated by the server before purchasing.	`string`	Validation: trimmed nonempty.
`invite_code`Optional Existing campaign-specific discount or invitation credential, revalidated by the server before purchasing.	`string`	Validation: trimmed nonempty.
`luggage_quantity`Optional Quantity of luggage in an event that actually supports the configured luggage option.	`integer`	Validation: >=0.
`attendee_information`Optional Answers matching the actual campaign-specific fields, required values and supported options.	`object`	Validation: string values matching configured fields.
`payment_channel`Optional Optional channel preference; only methods enabled for the real selling country, currency and merchant may be used.	`enum`	Validation: card \| mobile_money \| apple_pay \| bank_transfer \| crypto; availability is server-controlled.
`network_code`Optional Configured mobile network selection where the chosen payment channel requires it.	`string`	Validation: configured network.
`is_app`Optional Existing caller context used to select Web or User App configuration; it grants no extra permissions.	`boolean`	Validation: client context.
`web_abuse_context`Required Existing browser/device protection payload required before public checkout initialization; not a replacement for server authorization.	`object`	Validation: strict object; device_details JSON <=12000 characters.
`web_abuse_context.device_id`Required Existing browser/device protection signal accepted by the current public checkout protection schema.	`string`	Validation: 12–160.
`web_abuse_context.device_fingerprint`Required Existing browser/device protection signal accepted by the current public checkout protection schema.	`string`	Validation: 12–160.
`web_abuse_context.browser_signature`Optional Existing browser/device protection signal accepted by the current public checkout protection schema.	`string\|null`	Validation: 12–160.
`web_abuse_context.hardware_signature`Optional Existing browser/device protection signal accepted by the current public checkout protection schema.	`string\|null`	Validation: 12–160.
`web_abuse_context.device_details`Optional Existing browser/device protection signal accepted by the current public checkout protection schema.	`object`	Validation: JSON object.
`web_abuse_context.client_pattern_detected`Optional Existing browser/device protection signal accepted by the current public checkout protection schema.	`boolean`	Validation: existing device protection.
`client_attempt_id`Optional Stable client operation identifier used to reuse an existing attempt and reject mismatched retries.	`string`	Validation: stable normalized operation identity.
`return_path`Optional Relative return destination on the verified current website after centralized checkout.	`string`	Validation: same-origin relative path; no // or backslash.

Request

Examples describe the contract and are not executed. Use authorized test records; never paste a real secret into these pages.

POST /api/public/tickets/purchase

http

POST /api/public/tickets/purchase HTTP/1.1
Host: api.sparkglim.net
Content-Type: application/json

{
  "campaign_id": "11111111-1111-4111-8111-111111111111",
  "ticket_id": "22222222-2222-4222-8222-222222222222",
  "quantity": 1,
  "phone_number": "+233200000000",
  "web_abuse_context": {
    "device_id": "<EXISTING_DEVICE_ID>",
    "device_fingerprint": "<EXISTING_DEVICE_FINGERPRINT>"
  },
  "client_attempt_id": "example_stable_attempt_0001"
}

Response

Success response · HTTP 200

json

{
  "success": true,
  "data": {
    "id": "11111111-1111-4111-8111-111111111111",
    "status": "pending"
  }
}

Error response · HTTP 400

json

{
  "success": false,
  "error": "<ERROR_MESSAGE>"
}

Validation, permissions, unavailable records and temporary service failures use the handler’s HTTP status and error payload.

Limits & retries

Default Server limit: 100 requests per IP per 60 seconds. Resource-specific controls also apply.

Source compatibility

Authorized operations require account-specific testing.

server/src/api/router.ts
server/src/api/routes/public.ts

Access model

Request

Request

Response

Limits & retries

Source compatibility

Continue building