Scanner grants and self check-in
Offline manifest authority, organiser grant management, and short-lived door codes.
The three legacy /api/scan operations are documented separately in
Check-in sync. Scanner tokens are revocable, event-scoped grants; they
are not login sessions and do not grant access to the organiser console.
| Operation | Access | Purpose |
|---|---|---|
GET /api/scanner/manifest | Scanner grant | Download the bounded event ticket manifest for offline checking. |
GET /api/scanner/staff | Organiser | Staff, bound grants, and revocation state for an event. |
POST /api/scanner/grants | Organiser | Issue a signed scanner grant for a live eligible membership. |
DELETE /api/scanner/grants | Organiser | Revoke a grant immediately for online calls. |
POST /api/scanner/organiser-grant | Optional session | Resolve scanner, staff, or studio entry for the actor. |
GET /api/scanner/door-code | Organiser | Issue a short-lived self-check-in code and exact remaining lifetime. |
POST /api/scanner/self-check-in | Session | Return expired, missing-ticket, or checked-in actor state. |
A malformed or revoked manifest token returns 403; a grant whose event or
membership was removed returns 404. Revocation cannot retract a manifest
already stored on an offline device. Sync still rechecks the live grant before
accepting queued writes. Mutations require an exact configured Origin.