API reference
Generated HTTP contracts used by Xperience's first-party applications.
The public organiser API is not offered to third parties. These operations serve Xperience's first-party applications; documenting a route does not grant access. Protected operations still enforce the session, origin, live role, tenant, organiser, or scanner authority shown in the generated schema.
The machine-readable contract at GET /api/openapi is generated
from the same concrete Zod Endpoint schemas used by the API. Swagger UI and
/openapi.json consume that document rather than decorator-inferred empty DTOs.
Events and registration
Published events, booking, registration, signed tickets, and attendee hubs.
Payments
Buyer-owned checkout state and verified browser handbacks.
Partner and studio
Organiser events, teams, inventory, workshops, and live statistics.
Account and loyalty
Onboarding, export, erasure, notifications, points, codes, and giveaways.
Discovery
Listings, intent, claims, moderation, and source policy.
Scanner
Idempotent offline sync, undo, manifests, grants, and self check-in.
Reports and platform
Tenant analytics, MATRADE reporting, independent platform audit, and codes.
Contract migration
Better Auth transport, trusted origins, success statuses, and preserved paths.
Conventions
| Contract version | Semver for the HTTP contract only; current candidate 2.0.0. |
| Times | ISO 8601, UTC. Rendered in Asia/Kuala_Lumpur. |
| Money | Integer cents, never floats, with an explicit currency where applicable. |
| Phone numbers | E.164 (+60123456789) after normalisation. |
| Ids | UUID unless a field says it is a slug, signed code, or provider reference. |
| Mutations | Exact configured Origin required; direct Nest POST success is normally 201. |
Deployment status
The production service has not been cut over to the new application layout. The relative OpenAPI server URL means “the configured origin serving this document”; it is not a claim that any intended hostname is verified or live. Publishing this reference does not announce a public API or production migration.
The 2.0.0 candidate adds published pass-form questions and form analytics, organiser event discovery, location checkpoints and replacement assignments, scheduled event content, and account push-subscription controls. The generated OpenAPI document remains the executable source for request and response details; the pages here list the exact method and path coverage expected by the API contract tests.