Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Edfermachado/proyectoSistemas/llms.txt

Use this file to discover all available pages before exploring further.

When an attendee registers for a paid or free event in UniEvents, a unique ticketToken (UUID) is generated and stored on their attendees row. That token is encoded into a QR code displayed on the attendee’s ticket page. At the venue door, staff scan the QR and the mobile or web client sends the decoded token to POST /api/tickets/validate. The endpoint verifies the token, checks it has not already been used, marks it as scanned, and writes an audit row to scanLogs recording who scanned it and when.

​
POST /api/tickets/validate

Validates a QR ticket token, marks it as used by setting attendees.scannedAt = now(), and inserts a new row into scanLogs with the eventId, attendeeId, and the scannedBy user ID from the session.

​
Authentication

Required. The session must carry one of the following roles:
RoleDescription
tenant_adminFaculty administrator
event_managerManager assigned to the event
superadminPlatform-level superadmin
access_controlDoor staff role with scan-only permissions
Any other role — or a missing session — returns 401 Unauthorized.

​
Request Body

​
token
string
required
The ticketToken UUID decoded from the attendee’s QR code. This is a UUID string (e.g. "d290f1ee-6c54-4b01-90e6-d701748f0851").
curl -X POST "https://your-domain.com/api/tickets/validate" \
  -H "Content-Type: application/json" \
  -H "Cookie: session=<your-session-cookie>" \
  -d '{
    "token": "d290f1ee-6c54-4b01-90e6-d701748f0851"
  }'

​
Response 200 — Access Permitted

The token is valid and has not been scanned before. The attendee row is updated and a scan log entry is created.
​
success
boolean
Always true on a successful scan.
​
message
string
Human-readable confirmation string: "Acceso Permitido (200)".
​
attendee
object
Summary of the validated attendee.
{
  "success": true,
  "message": "Acceso Permitido (200)",
  "attendee": {
    "name": "María García",
    "type": "estudiante",
    "event": "Annual Engineering Symposium 2024"
  }
}

​
Response 404 — Token Not Found

No attendee record matches the provided token. The QR code may be malformed, forged, or belong to a different environment.
​
error
string
"Entrada no encontrada (404)"
{
  "error": "Entrada no encontrada (404)"
}

​
Response 409 — Already Scanned

The token was found but attendees.scannedAt is already set, meaning the ticket was previously validated.
​
error
string
"Entrada ya utilizada (409)"
​
scannedAt
string
ISO 8601 timestamp of the original scan, so staff can see when and verify with the attendee.
{
  "error": "Entrada ya utilizada (409)",
  "scannedAt": "2024-11-21T19:45:32.123Z"
}

​
Response 401 — Unauthorized

The request has no valid session or the authenticated user’s role is not in the allowed list.
​
error
string
"Unauthorized"
{
  "error": "Unauthorized"
}

​
Response 400 — Missing Token

The request body was received but the token field was absent or empty.
​
error
string
"Token is required"
{
  "error": "Token is required"
}

​
Error Summary

StatusCondition
200Token valid, attendee admitted, scan logged.
400token field missing from request body.
401Not authenticated or role not permitted.
404No attendee found with that ticketToken.
409Ticket was already scanned — scannedAt is returned.
500Unexpected server or database error.
Each token is single-use. Once a ticket has been successfully validated (200), the scannedAt field is permanently set on the attendees row. Any subsequent validation attempt for the same token will return 409, even if it is the same staff member re-scanning within seconds. Present the scannedAt timestamp from the 409 response to the attendee as proof of the earlier entry.

Build docs developers (and LLMs) love

Get started for freeTalk to us