Redeem a card invitation return code

POST /v1/developer/guest-auth/wallet/authorizations/redeem

Operation ID: redeemDeveloperGuestWalletAuthorization

BFF-only. Exchanges the single-use 60-second return code with its original S256 verifier and kidSid. Rechecks installation, collection, environment, callback, permissions and the unchanged verified guest. Session tokens belong only in the BFF; never browser storage. TEST requires an explicitly registered test guest.

Contract status

Field	Value
Maturity	`preview`
Required capability	`guest_auth.write`
Freshness class	`authenticated-state`
Quota cost	`1`

All operations require a Kismet Developer Bearer credential. Collection and resource authority is resolved from the credential’s installation grants; identifiers in the URL never grant access.

Request parameters

Name	In	Type	Required	Description
`origin`	header	string	yes
`x-kismet-csrf`	header	string	yes

Request body

The request body is JSON. The canonical schema is:

{
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "code": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{43}$"
    },
    "codeVerifier": {
      "type": "string",
      "pattern": "^[A-Za-z0-9._~-]{43,128}$"
    },
    "kidSid": {
      "type": "string",
      "pattern": "^kid_[A-Za-z0-9]{8}$"
    }
  },
  "required": [
    "code",
    "codeVerifier",
    "kidSid"
  ]
}

Minimal example:

{
  "code": "042817",
  "codeVerifier": "string",
  "kidSid": "kid_Ab12Cd34"
}

cURL

Set KISMET_API_ORIGIN=https://api.ksmt.app and configure KISMET_DEVELOPER_API_KEY in your environment. Run server-credential requests from your backend, not browser code.

Guest access tokens come from the signed-in guest session held by your backend. Forward a CSRF proof only after your same-origin backend validates it. If shown, KISMET_SITE_ORIGIN is the authorized origin of your site. Do not substitute a guest ID or an invented token.

curl --request POST \
  "$KISMET_API_ORIGIN/v1/developer/guest-auth/wallet/authorizations/redeem" \
  --header "Authorization: Bearer $KISMET_DEVELOPER_API_KEY" \
  --header "Accept: application/json" \
  --header "origin: $KISMET_SITE_ORIGIN" \
  --header "x-kismet-csrf: $VALIDATED_CSRF_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"code":"042817","codeVerifier":"string","kidSid":"kid_Ab12Cd34"}'

Responses

Status	Meaning
200	Success.
400	Invalid request parameters or body.
401	Missing, invalid, expired, or inappropriate credential/session.
403	Credential lacks the required grant/capability, or an origin/CSRF check failed.
404	The authorized resource was not found.
409	Request conflicts with the installation environment or current state.
410	The single-use authentication challenge is no longer valid.
429	Rate limit or quota exceeded; inspect response metadata before retrying.
503	A required Kismet dependency is temporarily unavailable.

200 response schema

Content type: application/json. Required fields, nullable values, and nested structures are defined below.

View complete response schema

{
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "kidSid": {
      "type": "string",
      "pattern": "^kid_[A-Za-z0-9]{8}$"
    },
    "requestId": {
      "type": "string",
      "format": "uuid"
    },
    "returnUrl": {
      "type": "string",
      "maxLength": 2048,
      "pattern": "^https?://[^\\s]+$"
    },
    "guest": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "guestProfileId": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "email",
        "guestProfileId"
      ]
    },
    "session": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "accessToken": {
          "type": "string"
        },
        "refreshToken": {
          "type": "string"
        },
        "expiresAt": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "accessToken",
        "refreshToken",
        "expiresAt"
      ]
    }
  },
  "required": [
    "kidSid",
    "requestId",
    "returnUrl",
    "guest",
    "session"
  ]
}