# unPLUG Loyalty App API v1, OpenAPI 3.1.
# Docs: https://docs.unplugdining.com  Support: support@unplugdining.com
# Items with x-status: coming-soon are designed but not released yet.
openapi: 3.1.0
info:
  title: unPLUG Loyalty App API
  summary: Run unPLUG Loyalty inside your own mobile app or website.
  description: |-
    What your app, your website and the server behind them call to run unPLUG Loyalty for guests: members, points, rewards, checkout, using offers, joining challenges, push and in-app messages, webhooks.

    Creating and running offers and challenges, adjusting points and reports happen in the unPLUG Dashboard. To automate those, see the Management API: https://docs.unplugdining.com/management

    Operations and schemas marked `x-status: coming-soon` (and tagged "Coming soon") are designed but not released; their shape can still change. Guides and examples: https://docs.unplugdining.com
  version: v1
  contact:
    name: unPLUG developer support
    email: support@unplugdining.com
    url: https://docs.unplugdining.com/support
servers:
- url: https://api.unplugdining.com/v1
  description: Production (uk_live_ keys)
- url: https://sandbox.api.unplugdining.com/v1
  description: Sandbox (uk_test_ keys)
security:
- secretKey: []
tags:
- name: Program and catalog
- name: Member tokens
- name: Members
- name: Communication preferences
- name: Activity
- name: Wallet
- name: Checkout
- name: Orders
- name: Challenges
- name: Devices and messages
- name: App events
- name: Webhook endpoints
- name: Events
- name: Webhook events
- name: Test helpers
- name: Hosted sign-in
- name: Coming soon
  description: Designed but not released yet.
paths:
  /program:
    get:
      operationId: getProgram
      summary: Get the program
      tags:
      - Program and catalog
      description: 'Scope: `program:read`.'
      security:
      - secretKey: []
      - memberToken: []
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Program'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /locations:
    get:
      operationId: listLocations
      summary: List locations
      tags:
      - Program and catalog
      description: 'Scope: `program:read`.'
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Location'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /rewards:
    get:
      operationId: listRewards
      summary: List rewards
      tags:
      - Program and catalog
      description: 'Scope: `program:read`.'
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Reward'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /rewards/{id}:
    get:
      operationId: getReward
      summary: Get a reward
      tags:
      - Program and catalog
      description: 'Scope: `program:read`.'
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Reward'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /member_tokens:
    post:
      operationId: createMemberToken
      summary: Create a member token
      tags:
      - Member tokens
      description: 'Scope: `member_tokens:create`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MemberTokenRequest'
      responses:
        '201':
          description: Created. The token lasts 15 minutes.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MemberToken'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/revoke_tokens:
    post:
      operationId: revokeMemberTokens
      summary: Revoke a member's tokens
      tags:
      - Member tokens
      description: 'Scope: `members:write`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '204':
          description: All of the member's tokens stop working.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members:
    post:
      operationId: createMember
      summary: Create a member
      tags:
      - Members
      description: 'Scope: `members:write`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKeyRequired'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MemberCreate'
      responses:
        '201':
          description: Created.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '200':
          description: 'The `external_id` already existed, or a member was linked by verified phone (`linked_existing:
            true`).'
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    get:
      operationId: findMembers
      summary: Find members
      tags:
      - Members
      description: |-
        Exact match on one of `external_id`, `email` or `phone`.

        Scope: `members:read`.
      security:
      - secretKey: []
      parameters:
      - name: external_id
        in: query
        schema:
          type: string
      - name: email
        in: query
        schema:
          type: string
          format: email
      - name: phone
        in: query
        schema:
          type: string
          description: E.164.
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Member'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me:
    get:
      operationId: getMe
      summary: Get the signed-in member
      tags:
      - Members
      security:
      - memberToken: []
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateMe
      summary: Update the signed-in member
      tags:
      - Members
      description: Member tokens can't change `phone`.
      security:
      - memberToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MemberUpdate'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    delete:
      operationId: deleteMe
      summary: Delete the signed-in member
      tags:
      - Members
      description: Deletion completes within 30 days, usually minutes. Fires `member.deleted`.
      security:
      - memberToken: []
      responses:
        '202':
          description: Accepted.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}:
    get:
      operationId: getMember
      summary: Get a member
      tags:
      - Members
      description: 'Scope: `members:read`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateMember
      summary: Update a member
      tags:
      - Members
      description: 'Scope: `members:write`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MemberUpdate'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Member'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    delete:
      operationId: deleteMember
      summary: Delete a member
      tags:
      - Members
      description: |-
        Deletion completes within 30 days, usually minutes. Personal data is erased, points and rewards are forfeited and `member.deleted` fires.

        Scope: `members:write`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '202':
          description: Accepted.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/identification_codes:
    post:
      operationId: createIdentificationCode
      summary: Create an in-store identification code
      tags:
      - Members
      - Coming soon
      x-status: coming-soon
      description: Coming soon. A 5-minute code to scan or type at the register.
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '201':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentificationCode'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/communication_preferences:
    get:
      operationId: getCommunicationPreferences
      summary: Get communication preferences
      tags:
      - Communication preferences
      description: 'Scope: `members:read`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommunicationPreferences'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateCommunicationPreferences
      summary: Update communication preferences
      tags:
      - Communication preferences
      description: |-
        Fires `communication_preferences.updated`. `source` is set automatically.

        Scope: `members:write`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CommunicationPreferencesUpdate'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommunicationPreferences'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/communication_preferences:
    get:
      operationId: getCommunicationPreferencesMe
      summary: Get communication preferences
      tags:
      - Communication preferences
      security:
      - memberToken: []
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommunicationPreferences'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateCommunicationPreferencesMe
      summary: Update communication preferences
      tags:
      - Communication preferences
      description: Fires `communication_preferences.updated`. `source` is set automatically.
      security:
      - memberToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CommunicationPreferencesUpdate'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommunicationPreferences'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/activity:
    get:
      operationId: listActivity
      summary: List a member's activity
      tags:
      - Activity
      description: |-
        Newest first.

        Scope: `members:read`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - name: from
        in: query
        schema:
          type: string
          format: date-time
      - name: to
        in: query
        schema:
          type: string
          format: date-time
      - name: type
        in: query
        schema:
          type: string
          enum:
          - earn
          - bonus
          - redeem
          - adjust
          - reverse
          - expire
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/ActivityEntry'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/activity:
    get:
      operationId: listMyActivity
      summary: List the signed-in member's activity
      tags:
      - Activity
      description: Newest first.
      security:
      - memberToken: []
      parameters:
      - name: from
        in: query
        schema:
          type: string
          format: date-time
      - name: to
        in: query
        schema:
          type: string
          format: date-time
      - name: type
        in: query
        schema:
          type: string
          enum:
          - earn
          - bonus
          - redeem
          - adjust
          - reverse
          - expire
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/ActivityEntry'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/wallet:
    get:
      operationId: listWallet
      summary: List a member's wallet
      tags:
      - Wallet
      description: 'Scope: `members:read`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - name: status
        in: query
        schema:
          type: string
          enum:
          - available
          - reserved
          - used
          - expired
          default: available
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/WalletItem'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/wallet:
    get:
      operationId: listMyWallet
      summary: List the signed-in member's wallet
      tags:
      - Wallet
      security:
      - memberToken: []
      parameters:
      - name: status
        in: query
        schema:
          type: string
          enum:
          - available
          - reserved
          - used
          - expired
          default: available
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/WalletItem'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /challenges:
    get:
      operationId: listChallenges
      summary: List challenges
      tags:
      - Challenges
      - Coming soon
      x-status: coming-soon
      description: |-
        Coming soon. Live challenges one member is eligible for: the token's member, or `member_id` with a secret key.

        Scope: `members:read`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - name: member_id
        in: query
        schema:
          type: string
          format: uuid
        description: 'Required with a secret key: the member to list for. Ignored with a member token.'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Challenge'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/challenges:
    get:
      operationId: listMyChallenges
      summary: List the signed-in member's challenges
      tags:
      - Challenges
      - Coming soon
      x-status: coming-soon
      description: 'Coming soon. '
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/MemberChallenge'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/challenges/{id}/join:
    post:
      operationId: joinChallenge
      summary: Join a challenge
      tags:
      - Challenges
      - Coming soon
      x-status: coming-soon
      description: 'Coming soon. '
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MemberChallenge'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/challenges:
    get:
      operationId: listMemberChallenges
      summary: List a member's challenges
      tags:
      - Challenges
      - Coming soon
      x-status: coming-soon
      description: |-
        Coming soon. Server-side version of GET /members/me/challenges.

        Scope: `members:read`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/MemberChallenge'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/challenges/{challenge_id}/join:
    post:
      operationId: joinChallengeForMember
      summary: Join a challenge for a member
      tags:
      - Challenges
      - Coming soon
      x-status: coming-soon
      description: |-
        Coming soon. Server-side version of POST /members/me/challenges/{id}/join.

        Scope: `members:write`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - name: challenge_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MemberChallenge'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /checkouts/preview:
    post:
      operationId: previewCheckout
      summary: Preview a checkout
      tags:
      - Checkout
      description: |-
        No side effects. A member token can preview only for itself. Limited to 20 requests per second per key.

        Scope: `checkout:write`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cart'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Preview'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /redemptions:
    post:
      operationId: createRedemption
      summary: Create a redemption
      tags:
      - Checkout
      description: |-
        Holds a reward, wallet item or code for 15 minutes. One per order at launch.

        Scope: `checkout:write`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKeyRequired'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RedemptionRequest'
      responses:
        '201':
          description: Created, status `reserved`.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Redemption'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '410':
          $ref: '#/components/responses/Gone'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /redemptions/{id}:
    get:
      operationId: getRedemption
      summary: Get a redemption
      tags:
      - Checkout
      description: |-
        A member token can read its own member's redemptions.

        Scope: `checkout:write`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Redemption'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /redemptions/{id}/cancel:
    post:
      operationId: cancelRedemption
      summary: Cancel a redemption
      tags:
      - Checkout
      description: |-
        Releases the hold. A member token can cancel its own member's redemptions, so the app can release a hold when the guest leaves checkout.

        Scope: `checkout:write`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Redemption'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /orders:
    post:
      operationId: createOrder
      summary: Create an order
      tags:
      - Orders
      description: |-
        Send once payment is captured. Captures the redemptions and credits points.

        Scope: `checkout:write`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKeyRequired'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderRequest'
      responses:
        '201':
          description: Created.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Order'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '410':
          $ref: '#/components/responses/Gone'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    get:
      operationId: listOrders
      summary: List orders
      tags:
      - Orders
      description: 'Scope: `checkout:write`.'
      security:
      - secretKey: []
      parameters:
      - name: member_id
        in: query
        schema:
          type: string
          format: uuid
      - name: external_order_id
        in: query
        schema:
          type: string
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Order'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /orders/{id}:
    get:
      operationId: getOrder
      summary: Get an order
      tags:
      - Orders
      description: 'Scope: `checkout:write`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Order'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /orders/{id}/refunds:
    post:
      operationId: createRefund
      summary: Create a refund
      tags:
      - Orders
      description: 'Scope: `checkout:write`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKeyRequired'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefundRequest'
      responses:
        '201':
          description: Created.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Refund'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/Unprocessable'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/devices/{device_id}:
    put:
      operationId: putDevice
      summary: Register a device
      tags:
      - Devices and messages
      security:
      - memberToken: []
      parameters:
      - name: device_id
        in: path
        required: true
        schema:
          type: string
        description: Stable id your app generates once per install.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceWrite'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Device'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    delete:
      operationId: deleteDevice
      summary: Remove a device
      tags:
      - Devices and messages
      security:
      - memberToken: []
      parameters:
      - name: device_id
        in: path
        required: true
        schema:
          type: string
        description: Stable id your app generates once per install.
      responses:
        '204':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/messages/next:
    get:
      operationId: getNextMessage
      summary: Get the next in-app message
      tags:
      - Devices and messages
      security:
      - memberToken: []
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Message'
        '204':
          description: Nothing to show.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/messages/{id}:
    get:
      operationId: getMessage
      summary: Get an in-app message
      tags:
      - Devices and messages
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Message'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/messages/{id}/events:
    post:
      operationId: createMessageEvent
      summary: Record a message event
      tags:
      - Devices and messages
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MessageEventRequest'
      responses:
        '204':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/messages/next:
    get:
      operationId: getNextMessageForMember
      summary: Get a member's next in-app message
      tags:
      - Devices and messages
      description: |-
        Server-side version of GET /members/me/messages/next.

        Scope: `members:read`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Message'
        '204':
          description: Nothing to show.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/{id}/messages/{message_id}/events:
    post:
      operationId: createMessageEventForMember
      summary: Record a message event for a member
      tags:
      - Devices and messages
      description: |-
        Server-side version of POST /members/me/messages/{id}/events.

        Scope: `members:write`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - name: message_id
        in: path
        required: true
        schema:
          type: string
          format: uuid
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MessageEventRequest'
      responses:
        '204':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /members/me/push_opens:
    post:
      operationId: createPushOpen
      summary: Record a push open
      tags:
      - Devices and messages
      security:
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PushOpenRequest'
      responses:
        '204':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '410':
          $ref: '#/components/responses/Gone'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /app_events:
    post:
      operationId: createAppEvents
      summary: Send app events
      tags:
      - App events
      description: |-
        Batch of up to 100. Deduped by `event_id`. With a secret key, send `member_id` or `anonymous_id`.

        Scope: `members:write`.
      security:
      - secretKey: []
      - memberToken: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppEventBatch'
      responses:
        '202':
          description: Accepted.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AppEventResult'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /webhook_endpoints:
    post:
      operationId: createWebhookEndpoint
      summary: Create a webhook endpoint
      tags:
      - Webhook endpoints
      description: |-
        Up to 10 per environment. The secret is returned once.

        Scope: `webhooks:manage`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointCreate'
      responses:
        '201':
          description: Created.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    get:
      operationId: listWebhookEndpoints
      summary: List webhook endpoints
      tags:
      - Webhook endpoints
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /webhook_endpoints/{id}:
    get:
      operationId: getWebhookEndpoint
      summary: Get a webhook endpoint
      tags:
      - Webhook endpoints
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    patch:
      operationId: updateWebhookEndpoint
      summary: Update a webhook endpoint
      tags:
      - Webhook endpoints
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WebhookEndpointUpdate'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
    delete:
      operationId: deleteWebhookEndpoint
      summary: Delete a webhook endpoint
      tags:
      - Webhook endpoints
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '204':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /webhook_endpoints/{id}/test:
    post:
      operationId: testWebhookEndpoint
      summary: Send a test event
      tags:
      - Webhook endpoints
      description: |-
        Sends `webhook.test` to this endpoint only.

        Scope: `webhooks:manage`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '202':
          description: Accepted.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /webhook_endpoints/{id}/rotate_secret:
    post:
      operationId: rotateWebhookSecret
      summary: Rotate the signing secret
      tags:
      - Webhook endpoints
      description: |-
        Both secrets sign until the current one expires.

        Scope: `webhooks:manage`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RotateSecretRequest'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /events:
    get:
      operationId: listEvents
      summary: List events
      tags:
      - Events
      description: |-
        Last 30 days, newest first.

        Scope: `webhooks:manage`.
      security:
      - secretKey: []
      parameters:
      - name: type
        in: query
        schema:
          type: string
          description: Event type. May grow.
          enum:
          - member.created
          - member.updated
          - member.deleted
          - points.changed
          - tier.changed
          - reward.issued
          - reward.redeemed
          - reward.expiring
          - order.credited
          - order.refunded
          - communication_preferences.updated
          - webhook.test
          - points.expiring
          - challenge.joined
          - challenge.progressed
          - challenge.completed
          - referral.completed
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Event'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /events/{id}:
    get:
      operationId: getEvent
      summary: Get an event
      tags:
      - Events
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /events/{id}/deliveries:
    get:
      operationId: listDeliveries
      summary: List deliveries
      tags:
      - Events
      description: 'Scope: `webhooks:manage`.'
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/Limit'
      - $ref: '#/components/parameters/Cursor'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Delivery'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /events/{id}/redeliver:
    post:
      operationId: redeliverEvent
      summary: Redeliver an event
      tags:
      - Events
      description: |-
        One attempt per endpoint, same `webhook-id`.

        Scope: `webhooks:manage`.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RedeliverRequest'
      responses:
        '202':
          description: Accepted.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/CursorList'
                - type: object
                  properties:
                    data:
                      type: array
                      items:
                        $ref: '#/components/schemas/Delivery'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /test/in_store_orders:
    servers:
    - url: https://sandbox.api.unplugdining.com/v1
      description: Sandbox only
    post:
      operationId: testInStoreOrder
      summary: Simulate a register visit
      tags:
      - Test helpers
      description: Sandbox only.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestInStoreOrderRequest'
      responses:
        '201':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Order'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /test/members/{id}/wallet:
    servers:
    - url: https://sandbox.api.unplugdining.com/v1
      description: Sandbox only
    post:
      operationId: testAddWalletItem
      summary: Put a reward in a wallet
      tags:
      - Test helpers
      description: Sandbox only.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestWalletRequest'
      responses:
        '201':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WalletItem'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /test/webhooks:
    servers:
    - url: https://sandbox.api.unplugdining.com/v1
      description: Sandbox only
    post:
      operationId: testFireWebhook
      summary: Fire a sample event
      tags:
      - Test helpers
      description: Sandbox only. Sends a sample event of this type to your subscribed endpoints.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TestWebhookRequest'
      responses:
        '202':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    format: uuid
                  type:
                    type: string
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /test/members/{id}/expire_wallet_items:
    servers:
    - url: https://sandbox.api.unplugdining.com/v1
      description: Sandbox only
    post:
      operationId: testExpireWalletItems
      summary: Expire wallet items now
      tags:
      - Test helpers
      description: Sandbox only.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/Id'
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                type: object
                properties:
                  expired:
                    type: integer
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /test/reset:
    servers:
    - url: https://sandbox.api.unplugdining.com/v1
      description: Sandbox only
    post:
      operationId: testReset
      summary: Reset the sandbox brand
      tags:
      - Test helpers
      description: Sandbox only. Deletes all members and orders.
      security:
      - secretKey: []
      parameters:
      - $ref: '#/components/parameters/IdempotencyKey'
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleted_members:
                    type: integer
                  deleted_orders:
                    type: integer
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/TooManyRequests'
  /authorize:
    servers:
    - url: https://auth.unplugdining.com
      description: Hosted sign-in
    get:
      operationId: authorize
      summary: Start hosted sign-in
      tags:
      - Hosted sign-in
      - Coming soon
      x-status: coming-soon
      description: Coming soon. OAuth 2.0 authorization code with PKCE (S256), opened in the system browser (RFC
        8252). The guest signs in with a phone number and SMS code on a page with your logo.
      security: []
      parameters:
      - name: response_type
        in: query
        required: true
        schema:
          type: string
          const: code
      - name: client_id
        in: query
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        schema:
          type: string
          format: uri
      - name: code_challenge
        in: query
        required: true
        schema:
          type: string
      - name: code_challenge_method
        in: query
        required: true
        schema:
          type: string
          const: S256
      - name: state
        in: query
        required: true
        schema:
          type: string
      responses:
        '302':
          description: Redirects to `redirect_uri` with `code` and `state`.
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
        '400':
          $ref: '#/components/responses/BadRequest'
  /token:
    servers:
    - url: https://auth.unplugdining.com
      description: Hosted sign-in
    post:
      operationId: token
      summary: Exchange a code or refresh token
      tags:
      - Hosted sign-in
      - Coming soon
      x-status: coming-soon
      description: Coming soon. Returns a member token and a rotating refresh token.
      security: []
      responses:
        '200':
          description: OK
          headers:
            Request-Id:
              $ref: '#/components/headers/Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HostedTokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                code:
                  type: string
                redirect_uri:
                  type: string
                  format: uri
                client_id:
                  type: string
                code_verifier:
                  type: string
                refresh_token:
                  type: string
              required:
              - grant_type
              - client_id
webhooks:
  member.created:
    post:
      operationId: webhook_member_created
      summary: member.created
      description: 'Fires when: A member is enrolled.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: member.created
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/Member'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  member.updated:
    post:
      operationId: webhook_member_updated
      summary: member.updated
      description: 'Fires when: Profile fields, external_id or status change. `previous_attributes` holds old values.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: member.updated
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/Member'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  member.deleted:
    post:
      operationId: webhook_member_deleted
      summary: member.deleted
      description: 'Fires when: A deletion completes and personal data is erased.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: member.deleted
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/DeletedMember'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  points.changed:
    post:
      operationId: webhook_points_changed
      summary: points.changed
      description: 'Fires when: Any activity entry is written.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: points.changed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/ActivityEntryEvent'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  points.expiring:
    post:
      operationId: webhook_points_expiring
      summary: points.expiring
      description: 'Coming soon. Fires when: A member''s points are about to expire.'
      tags:
      - Webhook events
      - Coming soon
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: points.expiring
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/PointsExpiring'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
      x-status: coming-soon
  tier.changed:
    post:
      operationId: webhook_tier_changed
      summary: tier.changed
      description: 'Fires when: A member moves up or down a tier.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: tier.changed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/TierChange'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  reward.issued:
    post:
      operationId: webhook_reward_issued
      summary: reward.issued
      description: 'Fires when: A reward lands in a member''s wallet.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: reward.issued
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/WalletItemEvent'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  reward.redeemed:
    post:
      operationId: webhook_reward_redeemed
      summary: reward.redeemed
      description: 'Fires when: A redemption is captured by an order.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: reward.redeemed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/Redemption'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  reward.expiring:
    post:
      operationId: webhook_reward_expiring
      summary: reward.expiring
      description: 'Fires when: 3 days before an available wallet item expires.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: reward.expiring
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/WalletItemEvent'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  order.credited:
    post:
      operationId: webhook_order_credited
      summary: order.credited
      description: 'Fires when: An order is credited, including points earned at the register (`channel: in_store`).'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: order.credited
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/Order'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  order.refunded:
    post:
      operationId: webhook_order_refunded
      summary: order.refunded
      description: 'Fires when: A refund is recorded, partial or full.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: order.refunded
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/Refund'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  communication_preferences.updated:
    post:
      operationId: webhook_communication_preferences_updated
      summary: communication_preferences.updated
      description: 'Fires when: A marketing opt-in changes.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: communication_preferences.updated
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/CommunicationPreferencesEvent'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
  challenge.joined:
    post:
      operationId: webhook_challenge_joined
      summary: challenge.joined
      description: 'Coming soon. Fires when: A member is enrolled in a challenge.'
      tags:
      - Webhook events
      - Coming soon
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: challenge.joined
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/MemberChallenge'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
      x-status: coming-soon
  challenge.progressed:
    post:
      operationId: webhook_challenge_progressed
      summary: challenge.progressed
      description: 'Coming soon. Fires when: Challenge progress moves.'
      tags:
      - Webhook events
      - Coming soon
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: challenge.progressed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/MemberChallenge'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
      x-status: coming-soon
  challenge.completed:
    post:
      operationId: webhook_challenge_completed
      summary: challenge.completed
      description: 'Coming soon. Fires when: A member completes a challenge.'
      tags:
      - Webhook events
      - Coming soon
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: challenge.completed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/MemberChallenge'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
      x-status: coming-soon
  referral.completed:
    post:
      operationId: webhook_referral_completed
      summary: referral.completed
      description: 'Coming soon. Fires when: A referred guest qualifies.'
      tags:
      - Webhook events
      - Coming soon
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: referral.completed
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/ReferralCompleted'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
      x-status: coming-soon
  webhook.test:
    post:
      operationId: webhook_webhook_test
      summary: webhook.test
      description: 'Fires when: You call POST /v1/webhook_endpoints/{id}/test.'
      tags:
      - Webhook events
      parameters:
      - name: webhook-id
        in: header
        required: true
        schema:
          type: string
        description: The event id.
      - name: webhook-timestamp
        in: header
        required: true
        schema:
          type: string
        description: Unix seconds. Reject if more than 5 minutes off.
      - name: webhook-signature
        in: header
        required: true
        schema:
          type: string
        description: Space-separated `v1,<base64 HMAC-SHA256>` entries over `{webhook-id}.{webhook-timestamp}.{raw
          body}`, keyed with the base64-decoded part of the secret after `whsec_`.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              allOf:
              - $ref: '#/components/schemas/Event'
              - type: object
                properties:
                  type:
                    type: string
                    const: webhook.test
                  data:
                    type: object
                    properties:
                      object:
                        $ref: '#/components/schemas/WebhookTest'
                      previous_attributes:
                        type: object
      responses:
        2XX:
          description: Delivered. Respond within 10 seconds; anything else is retried.
components:
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      bearerFormat: uk_live_... or uk_test_...
      description: Secret key, server side only. Scopes limit what each key can do.
    memberToken:
      type: http
      scheme: bearer
      bearerFormat: mt_...
      description: Member token from POST /v1/member_tokens. Lasts 15 minutes and acts for one member.
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      required: false
      description: 'Any string up to 255 characters; use a UUID v4. Kept 24 hours per key (or member) and endpoint.
        Same key and body replays the first response with `Idempotent-Replayed: true`.'
      schema:
        type: string
        maxLength: 255
    IdempotencyKeyRequired:
      name: Idempotency-Key
      in: header
      required: true
      description: Required on this endpoint. Any string up to 255 characters; use a UUID v4. Missing returns `400
        idempotency_key_required`.
      schema:
        type: string
        maxLength: 255
    Limit:
      name: limit
      in: query
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 25
    Cursor:
      name: cursor
      in: query
      schema:
        type: string
      description: '`next_cursor` from the previous page.'
    Id:
      name: id
      in: path
      required: true
      schema:
        type: string
        format: uuid
    ChallengeStatus:
      name: status
      in: query
      description: Only challenges in this status.
      schema:
        type: string
        enum:
        - draft
        - scheduled
        - live
        - paused
        - ended
  headers:
    Request-Id:
      description: Quote it to support.
      schema:
        type: string
        examples:
        - req_7Hq2kD9xLm
    RateLimit-Limit:
      schema:
        type: integer
    RateLimit-Remaining:
      schema:
        type: integer
    RateLimit-Reset:
      schema:
        type: integer
      description: Seconds until the window resets.
    Retry-After:
      schema:
        type: integer
      description: Seconds.
    Idempotent-Replayed:
      schema:
        type: string
        enum:
        - 'true'
  responses:
    BadRequest:
      description: '`invalid_request`, `invalid_param`, `missing_param` or `idempotency_key_required`.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Unauthorized:
      description: '`invalid_api_key` or `token_expired`.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Forbidden:
      description: '`missing_scope`, or a member token calling something it can''t.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    NotFound:
      description: '`not_found` or a resource-specific not-found code.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Gone:
      description: '`member_deleted`.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Conflict:
      description: '`request_in_progress`, `phone_in_use`, `order_already_exists`, `redemption_not_reserved`, or
        `invalid_state` when the object''s status doesn''t allow the action.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    Unprocessable:
      description: The request is well formed but can't be done. `idempotency_key_reused` and business errors such
        as `insufficient_points`.
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    TooManyRequests:
      description: '`rate_limited`.'
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
        Retry-After:
          $ref: '#/components/headers/Retry-After'
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
    NoContent:
      description: No content.
      headers:
        Request-Id:
          $ref: '#/components/headers/Request-Id'
  schemas:
    Problem:
      type: object
      properties:
        type:
          type: string
          description: Link to the docs for this error.
          format: uri
          examples:
          - https://docs.unplugdining.com/reference/errors#insufficient_points
        title:
          type: string
          examples:
          - Not enough points
        status:
          type: integer
          examples:
          - 422
        code:
          $ref: '#/components/schemas/ErrorCode'
        detail:
          type: string
          description: A sentence about this occurrence.
          examples:
          - This reward costs 500 Beans. The member has 420.
        param:
          type:
          - string
          - 'null'
          description: The request field at fault, when there is one.
        order_id:
          type: string
          format: uuid
          description: 'Only on `order_already_exists`: the order that was already credited.'
        request_id:
          type: string
          description: Same as the `Request-Id` header.
          examples:
          - req_7Hq2kD9xLm
      required:
      - type
      - title
      - status
      - code
      - request_id
      description: RFC 9457 problem details, served as `application/problem+json`.
    ErrorCode:
      type: string
      description: Machine-readable error code. May grow.
      enum:
      - invalid_request
      - invalid_param
      - missing_param
      - invalid_api_key
      - token_expired
      - missing_scope
      - not_found
      - member_not_found
      - member_deleted
      - external_id_taken
      - phone_in_use
      - idempotency_key_required
      - idempotency_key_reused
      - request_in_progress
      - rate_limited
      - insufficient_points
      - reward_not_found
      - reward_not_applicable
      - reward_expired
      - reward_already_used
      - code_invalid
      - code_expired
      - code_limit_reached
      - redemption_expired
      - redemption_not_reserved
      - one_redemption_per_order
      - order_already_exists
      - refund_exceeds_order
      - location_not_found
      - challenge_not_joinable
      - invalid_state
      - internal_error
      - service_unavailable
    ReasonCode:
      type: string
      description: Why a reward or code doesn't apply. May grow.
      enum:
      - below_minimum_subtotal
      - wrong_channel
      - wrong_location
      - wrong_fulfillment
      - outside_available_times
      - item_not_in_cart
      - tier_required
      - not_enough_points
      - per_member_limit_reached
      - budget_exhausted
      - not_started
      - expired
      - already_used
    CursorList:
      type: object
      properties:
        data:
          type: array
          items: {}
        has_more:
          type: boolean
          description: True when another page exists.
        next_cursor:
          type:
          - string
          - 'null'
          description: Pass as `cursor` to get the next page.
      required:
      - data
      - has_more
      - next_cursor
      description: Cursor-paginated list. `?limit=` (1 to 100, default 25) and `?cursor=`.
    TierRef:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - Green
      required:
      - id
      - name
    Tier:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - Gold
        min_lifetime_points:
          type: integer
          examples:
          - 2000
        upgrade_bonus_points:
          type: integer
          description: Points added when a member reaches this tier.
          examples:
          - 200
      required:
      - id
      - name
      - min_lifetime_points
    Program:
      type: object
      properties:
        brand_id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - Rewards
        point_name:
          type: object
          properties:
            singular:
              type: string
              examples:
              - Bean
            plural:
              type: string
              examples:
              - Beans
          required:
          - singular
          - plural
        earning:
          type: object
          properties:
            type:
              type: string
              enum:
              - spend
              - visit
            points_per_dollar:
              type: integer
              description: When `type` is `spend`.
              examples:
              - 10
            points_per_visit:
              type: integer
              description: When `type` is `visit`.
            rounding:
              type: string
              enum:
              - down
            earn_on:
              type: string
              enum:
              - subtotal
              description: Points are earned on the subtotal after discounts.
          required:
          - type
          - rounding
          - earn_on
        tiers:
          type: array
          items:
            $ref: '#/components/schemas/Tier'
        default_time_zone:
          type: string
          description: IANA time zone.
          examples:
          - America/Chicago
        currency:
          type: string
          description: ISO 4217 code. `USD`.
          examples:
          - USD
        points_expiry:
          type:
          - object
          - 'null'
          description: Coming soon. Null while points don't expire.
          x-status: coming-soon
          properties:
            days_inactive:
              type: integer
              examples:
              - 365
      required:
      - brand_id
      - name
      - point_name
      - earning
      - tiers
      - default_time_zone
      - currency
    Address:
      type: object
      properties:
        line1:
          type: string
        line2:
          type:
          - string
          - 'null'
        city:
          type: string
        region:
          type: string
        postal_code:
          type: string
        country:
          type: string
          description: ISO 3166-1 alpha-2.
          examples:
          - US
    Location:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - South Congress
        address:
          $ref: '#/components/schemas/Address'
        time_zone:
          type: string
          examples:
          - America/Chicago
        pos:
          type: string
          enum:
          - square
        pos_location_id:
          type: string
          examples:
          - LQ7H2XK9M3RTB
        status:
          type: string
          enum:
          - live
          - not_live
      required:
      - id
      - name
      - time_zone
      - status
    Discount:
      type: object
      properties:
        type:
          type: string
          enum:
          - amount
          - percent
          - free_item
          - bogo
        amount_cents:
          type: integer
          description: For `amount`.
        percent:
          type: number
          description: For `percent`.
        items:
          type: array
          items:
            type: object
            properties:
              pos_item_id:
                type: string
              name:
                type: string
          description: Item scope, by Square variation id.
        categories:
          type: array
          items:
            type: object
            properties:
              pos_category_id:
                type: string
              name:
                type: string
          description: Category scope.
        max_items:
          type: integer
      required:
      - type
    AvailableTime:
      type: object
      properties:
        days:
          type: array
          items:
            type: string
            enum:
            - mon
            - tue
            - wed
            - thu
            - fri
            - sat
            - sun
        start:
          type: string
          description: Local time, HH:MM.
          examples:
          - 07:00
        end:
          type: string
          description: Local time, HH:MM.
          examples:
          - '11:00'
    Rules:
      type: object
      properties:
        min_subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        channels:
          type: array
          items:
            type: string
            enum:
            - app
            - web
        location_ids:
          type: array
          items:
            type: string
            format: uuid
        fulfillment:
          type: array
          items:
            type: string
            enum:
            - pickup
            - delivery
            - curbside
            - dine_in
        available_times:
          type: array
          items:
            $ref: '#/components/schemas/AvailableTime'
        tier_ids:
          type: array
          items:
            type: string
            format: uuid
      description: Empty arrays mean no limit.
    Reward:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - Free drip coffee
        description:
          type: string
        image_url:
          type:
          - string
          - 'null'
          format: uri
        kind:
          type: string
          description: '`points`: catalog reward bought with points at checkout. `wallet`: issued to the wallet
            (offers, challenges, birthday, support, tier).'
          enum:
          - points
          - wallet
        points_cost:
          type: integer
          description: Points rewards only. Absent on wallet rewards.
          examples:
          - 500
        discount:
          $ref: '#/components/schemas/Discount'
        rules:
          $ref: '#/components/schemas/Rules'
        starts_at:
          type:
          - string
          - 'null'
          format: date-time
        ends_at:
          type:
          - string
          - 'null'
          format: date-time
      required:
      - id
      - name
      - kind
      - discount
      - rules
    Member:
      type: object
      properties:
        id:
          type: string
          format: uuid
        external_id:
          type:
          - string
          - 'null'
          maxLength: 128
          examples:
          - usr_10482
        status:
          type: string
          enum:
          - active
          - deleted
        first_name:
          type:
          - string
          - 'null'
          examples:
          - Maya
        last_name:
          type:
          - string
          - 'null'
          examples:
          - Lopez
        email:
          type:
          - string
          - 'null'
          format: email
          examples:
          - maya@example.com
        phone:
          type:
          - string
          - 'null'
          description: E.164.
          examples:
          - '+15125550142'
        phone_verified:
          type: boolean
        birthday:
          type:
          - string
          - 'null'
          format: date
          examples:
          - '1994-03-18'
        points_balance:
          type: integer
          examples:
          - 420
        lifetime_points:
          type: integer
          examples:
          - 1880
        tier:
          $ref: '#/components/schemas/TierRef'
        next_tier:
          type:
          - object
          - 'null'
          properties:
            id:
              type: string
              format: uuid
            name:
              type: string
            points_needed:
              type: integer
        communication_preferences:
          type: object
          properties:
            email_marketing:
              type: boolean
            sms_marketing:
              type: boolean
            push_marketing:
              type: boolean
        metadata:
          type: object
          additionalProperties:
            type: string
            maxLength: 500
          maxProperties: 20
        linked_existing:
          type: boolean
          description: 'Only on create: true when an existing member was linked by verified phone.'
        enrolled_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
      - id
      - status
      - points_balance
      - lifetime_points
      - tier
      - created_at
      - updated_at
    MemberCreate:
      type: object
      properties:
        external_id:
          type: string
          maxLength: 128
          examples:
          - usr_10482
        first_name:
          type: string
        last_name:
          type: string
        email:
          type: string
          format: email
        phone:
          type: string
          description: E.164.
        phone_verified:
          type: boolean
        birthday:
          type: string
          format: date
        communication_preferences:
          type: object
          properties:
            email_marketing:
              type: boolean
            sms_marketing:
              type: boolean
            push_marketing:
              type: boolean
        metadata:
          type: object
          additionalProperties:
            type: string
            maxLength: 500
          maxProperties: 20
      required:
      - external_id
    MemberUpdate:
      type: object
      properties:
        first_name:
          type: string
        last_name:
          type: string
        email:
          type: string
          format: email
        phone:
          type: string
          description: E.164. Secret key only.
        phone_verified:
          type: boolean
          description: Secret key only.
        birthday:
          type: string
          description: Set once from the app; a secret key can correct it.
          format: date
        metadata:
          type: object
          additionalProperties:
            type: string
            maxLength: 500
          maxProperties: 20
    CommunicationPreferences:
      type: object
      properties:
        email_marketing:
          type: boolean
        sms_marketing:
          type: boolean
        push_marketing:
          type: boolean
        updated_at:
          type: string
          format: date-time
        source:
          type: string
          description: Set automatically.
          enum:
          - app
          - web
          - api
          - unsubscribe_link
      required:
      - email_marketing
      - sms_marketing
      - push_marketing
      - updated_at
      - source
    CommunicationPreferencesUpdate:
      type: object
      properties:
        email_marketing:
          type: boolean
        sms_marketing:
          type: boolean
        push_marketing:
          type: boolean
    MemberTokenRequest:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        external_id:
          type: string
      description: Send `member_id` or `external_id`.
    MemberToken:
      type: object
      properties:
        token:
          type: string
          description: Opaque, starts with `mt_`.
          examples:
          - mt_4kQ9xV2mR7tB8nW3pL6yZ1cH5fJ0dS
        expires_at:
          type: string
          format: date-time
        member_id:
          type: string
          format: uuid
      required:
      - token
      - expires_at
      - member_id
    ActivityEntry:
      type: object
      properties:
        id:
          type: string
          format: uuid
        type:
          type: string
          description: May grow. `expire` is coming soon.
          enum:
          - earn
          - bonus
          - redeem
          - adjust
          - reverse
          - expire
        points:
          type: integer
          description: Signed.
        balance_after:
          type: integer
        description:
          type: string
          examples:
          - Order app-30417
        order_id:
          type:
          - string
          - 'null'
          format: uuid
        reward_id:
          type:
          - string
          - 'null'
          format: uuid
        adjustment_reason:
          type:
          - string
          - 'null'
          enum:
          - goodwill
          - correction
          - migration
          - other
          - null
        created_at:
          type: string
          format: date-time
      required:
      - id
      - type
      - points
      - balance_after
      - created_at
    WalletItem:
      type: object
      properties:
        id:
          type: string
          format: uuid
        reward:
          $ref: '#/components/schemas/Reward'
        source:
          type: string
          enum:
          - tier
          - offer
          - challenge
          - journey
          - support
          - birthday
        offer_id:
          type:
          - string
          - 'null'
          format: uuid
        status:
          type: string
          enum:
          - available
          - reserved
          - used
          - expired
        issued_at:
          type: string
          format: date-time
        expires_at:
          type:
          - string
          - 'null'
          format: date-time
        used_at:
          type:
          - string
          - 'null'
          format: date-time
        order_id:
          type:
          - string
          - 'null'
          format: uuid
      required:
      - id
      - reward
      - source
      - status
      - issued_at
    CartItem:
      type: object
      properties:
        line_id:
          type: string
          description: Your id for the line, unique within the cart.
        pos_item_id:
          type: string
          description: Square catalog item variation id.
          examples:
          - HV4MZ2TQ7LW3KXRB5P8NJ6DC
        name:
          type: string
          examples:
          - Oat latte
        quantity:
          type: integer
          minimum: 1
        unit_price_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        pos_category_ids:
          type: array
          items:
            type: string
        modifiers:
          type: array
          items:
            type: object
            properties:
              pos_modifier_id:
                type: string
              name:
                type: string
              price_cents:
                type: integer
                description: Integer cents.
                minimum: 0
      required:
      - line_id
      - name
      - quantity
      - unit_price_cents
    Cart:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        location_id:
          type: string
          format: uuid
        channel:
          type: string
          description: '`app` or `web`.'
          enum:
          - app
          - web
        fulfillment:
          type: string
          enum:
          - pickup
          - delivery
          - curbside
          - dine_in
        currency:
          type: string
          description: ISO 4217 code. `USD`.
          examples:
          - USD
        subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        items:
          type: array
          items:
            $ref: '#/components/schemas/CartItem'
        codes:
          type: array
          items:
            type: string
          examples:
          - - WELCOME10
        reward_ids:
          type: array
          items:
            type: string
            format: uuid
        wallet_item_ids:
          type: array
          items:
            type: string
            format: uuid
      required:
      - location_id
      - channel
      - fulfillment
      - currency
      - subtotal_cents
      - items
      description: Checkout preview request. Omit `member_id` for a guest with a code.
    PreviewEntry:
      type: object
      properties:
        type:
          type: string
          enum:
          - reward
          - wallet_item
          - code
        reward_id:
          type: string
          format: uuid
        wallet_item_id:
          type: string
          format: uuid
        code:
          type: string
        name:
          type: string
        points_cost:
          type: integer
          description: For `reward`.
        discount_cents:
          type: integer
          description: Applicable entries only.
        affected_line_ids:
          type: array
          items:
            type: string
          description: Applicable entries only.
        reason:
          $ref: '#/components/schemas/ReasonCode'
        message:
          type: string
          description: Not-applicable entries only. Safe to show guests.
      required:
      - type
      - name
    Preview:
      type: object
      properties:
        member_id:
          type:
          - string
          - 'null'
          format: uuid
        points_balance:
          type:
          - integer
          - 'null'
        points_to_earn:
          type: integer
        applicable:
          type: array
          items:
            $ref: '#/components/schemas/PreviewEntry'
        not_applicable:
          type: array
          items:
            $ref: '#/components/schemas/PreviewEntry'
        challenge_progress:
          type: array
          items:
            type: object
          description: Filled when challenges ship (coming soon).
      required:
      - applicable
      - not_applicable
    RedemptionRequest:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        location_id:
          type: string
          format: uuid
        channel:
          type: string
          description: '`app` or `web`.'
          enum:
          - app
          - web
        fulfillment:
          type: string
          enum:
          - pickup
          - delivery
          - curbside
          - dine_in
        currency:
          type: string
          description: ISO 4217 code. `USD`.
          examples:
          - USD
        subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        items:
          type: array
          items:
            $ref: '#/components/schemas/CartItem'
        reward_id:
          type: string
          format: uuid
        wallet_item_id:
          type: string
          format: uuid
        code:
          type: string
      required:
      - location_id
      - channel
      - fulfillment
      - currency
      - subtotal_cents
      - items
      description: Send exactly one of `reward_id`, `wallet_item_id` or `code`.
    Redemption:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          type: string
          enum:
          - reserved
          - captured
          - canceled
          - expired
          - reversed
        member_id:
          type:
          - string
          - 'null'
          format: uuid
        reward_id:
          type:
          - string
          - 'null'
          format: uuid
        wallet_item_id:
          type:
          - string
          - 'null'
          format: uuid
        code:
          type:
          - string
          - 'null'
        discount_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        points_cost:
          type: integer
        affected_line_ids:
          type: array
          items:
            type: string
        order_id:
          type:
          - string
          - 'null'
          format: uuid
        expires_at:
          type: string
          format: date-time
        created_at:
          type: string
          format: date-time
      required:
      - id
      - status
      - discount_cents
      - points_cost
      - expires_at
    OrderRequest:
      type: object
      properties:
        external_order_id:
          type: string
          maxLength: 128
          examples:
          - app-30417
        member_id:
          type: string
          format: uuid
        location_id:
          type: string
          format: uuid
        channel:
          type: string
          description: '`app` or `web`.'
          enum:
          - app
          - web
        fulfillment:
          type: string
          enum:
          - pickup
          - delivery
          - curbside
          - dine_in
        currency:
          type: string
          description: ISO 4217 code. `USD`.
          examples:
          - USD
        subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        items:
          type: array
          items:
            $ref: '#/components/schemas/CartItem'
        placed_at:
          type: string
          format: date-time
        discount_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        tax_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        tip_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        total_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        redemption_ids:
          type: array
          items:
            type: string
            format: uuid
          maxItems: 1
          description: One at launch.
        attribution:
          type: object
          x-status: coming-soon
          description: Coming soon.
          properties:
            link_id:
              type: string
      required:
      - external_order_id
      - location_id
      - channel
      - fulfillment
      - placed_at
      - currency
      - subtotal_cents
      - discount_cents
      - tax_cents
      - tip_cents
      - total_cents
      - items
    Order:
      type: object
      properties:
        id:
          type: string
          format: uuid
        external_order_id:
          type:
          - string
          - 'null'
        status:
          type: string
          enum:
          - credited
          - partially_refunded
          - refunded
        member_id:
          type:
          - string
          - 'null'
          format: uuid
        location_id:
          type: string
          format: uuid
        channel:
          type: string
          description: '`in_store` for points earned at the register. May grow.'
          enum:
          - app
          - web
          - in_store
        fulfillment:
          type:
          - string
          - 'null'
        placed_at:
          type: string
          format: date-time
        currency:
          type: string
          description: ISO 4217 code. `USD`.
          examples:
          - USD
        subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        discount_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        tax_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        tip_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        total_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        items:
          type: array
          items:
            $ref: '#/components/schemas/CartItem'
        points_earned:
          type: integer
        bonus_points:
          type: integer
        redemptions:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                format: uuid
              status:
                type: string
        member:
          type:
          - object
          - 'null'
          description: Balance and tier right after the order. Only on the create response and the `order.credited`
            webhook.
          properties:
            points_balance:
              type: integer
            tier:
              $ref: '#/components/schemas/TierRef'
        created_at:
          type: string
          format: date-time
      required:
      - id
      - status
      - location_id
      - channel
      - currency
      - subtotal_cents
      - points_earned
      - created_at
    RefundRequest:
      type: object
      properties:
        external_refund_id:
          type: string
          examples:
          - rf-30417-1
        amount_cents:
          type: integer
          description: Part of the subtotal refunded. Send this or `full`.
          minimum: 1
        full:
          type: boolean
        reason:
          type: string
          examples:
          - requested_by_customer
      required:
      - external_refund_id
    Refund:
      type: object
      properties:
        id:
          type: string
          format: uuid
        order_id:
          type: string
          format: uuid
        external_refund_id:
          type: string
        amount_cents:
          type: integer
          description: Integer cents.
          minimum: 0
        full:
          type: boolean
        reason:
          type:
          - string
          - 'null'
        points_reversed:
          type: integer
          description: Round down(points earned x refunded amount / order subtotal after discounts).
        points_shortfall:
          type: integer
          description: Points that couldn't be taken back because they were already spent.
        order_status:
          type: string
          enum:
          - partially_refunded
          - refunded
        member_id:
          type:
          - string
          - 'null'
          format: uuid
        member:
          type:
          - object
          - 'null'
          description: The member's balance after the refund. Null for a guest order.
          properties:
            points_balance:
              type: integer
        created_at:
          type: string
          format: date-time
      required:
      - id
      - order_id
      - external_refund_id
      - amount_cents
      - full
      - points_reversed
      - points_shortfall
      - order_status
      - created_at
    IdentificationCode:
      type: object
      properties:
        code:
          type: string
          examples:
          - '482913'
        qr_payload:
          type: string
        expires_at:
          type: string
          format: date-time
      required:
      - code
      - qr_payload
      - expires_at
      description: Coming soon. Valid for 5 minutes.
      x-status: coming-soon
    Challenge:
      type: object
      properties:
        id:
          type: string
          format: uuid
        name:
          type: string
        description:
          type: string
        image_url:
          type:
          - string
          - 'null'
          format: uri
        type:
          type: string
          enum:
          - visits
          - streak
          - spend
          - menu_discovery
        goal:
          type: object
          properties:
            target:
              type: integer
            unit:
              type: string
              enum:
              - visits
              - periods
              - cents
              - items
            period:
              type:
              - string
              - 'null'
              enum:
              - day
              - week
              - null
            grace_periods:
              type:
              - integer
              - 'null'
            item_set:
              type: array
              items:
                type: object
        qualifying:
          type: object
          properties:
            min_subtotal_cents:
              type: integer
              description: Integer cents.
              minimum: 0
            channels:
              type: array
              items:
                type: string
            location_ids:
              type: array
              items:
                type: string
                format: uuid
            fulfillment:
              type: array
              items:
                type: string
                enum:
                - pickup
                - delivery
                - curbside
                - dine_in
            available_times:
              type: array
              items:
                $ref: '#/components/schemas/AvailableTime'
            max_counted_per_day:
              type: integer
              examples:
              - 1
        window:
          oneOf:
          - type: object
            properties:
              kind:
                type: string
                const: fixed
              starts_at:
                type: string
                format: date-time
              ends_at:
                type: string
                format: date-time
            required:
            - kind
          - type: object
            properties:
              kind:
                type: string
                const: rolling
              days:
                type: integer
                examples:
                - 7
            required:
            - kind
        enrollment:
          type: string
          enum:
          - automatic
          - opt_in
        reward:
          oneOf:
          - type: object
            properties:
              kind:
                type: string
                const: points
              points:
                type: integer
            required:
            - kind
          - type: object
            properties:
              kind:
                type: string
                const: reward
              reward_id:
                type: string
                format: uuid
            required:
            - kind
        max_completions_per_member:
          type: integer
          examples:
          - 1
        budget:
          type: object
          properties:
            max_completions:
              type:
              - integer
              - 'null'
        status:
          type: string
          enum:
          - draft
          - scheduled
          - live
          - paused
          - ended
        version:
          type: integer
      required:
      - id
      - name
      - type
      - goal
      - window
      - enrollment
      - reward
      - status
      description: Coming soon.
      x-status: coming-soon
    MemberChallenge:
      type: object
      properties:
        challenge_id:
          type: string
          format: uuid
        member_id:
          type: string
          format: uuid
        status:
          type: string
          enum:
          - eligible
          - enrolled
          - completed
          - expired
        progress:
          type: object
          properties:
            current:
              type: integer
            target:
              type: integer
            unit:
              type: string
              enum:
              - visits
              - periods
              - cents
              - items
            periods:
              type: array
              items:
                type: object
                properties:
                  starts_at:
                    type: string
                    format: date-time
                  ends_at:
                    type: string
                    format: date-time
                  met:
                    type: boolean
        window_ends_at:
          type:
          - string
          - 'null'
          format: date-time
        completed_at:
          type:
          - string
          - 'null'
          format: date-time
        reward_wallet_item_id:
          type:
          - string
          - 'null'
          format: uuid
      required:
      - challenge_id
      - status
      - progress
      description: Coming soon. A member's progress on a challenge. `member_id` appears in webhooks.
      x-status: coming-soon
    DeviceWrite:
      type: object
      properties:
        platform:
          type: string
          enum:
          - ios
          - android
        push_token:
          type:
          - string
          - 'null'
          description: Null until the app has a token.
        token_type:
          type: string
          description: Required with `push_token`.
          enum:
          - fcm
          - apns
        app_id:
          type: string
          examples:
          - com.example.app
        push_enabled:
          type: boolean
          description: OS notification permission.
        app_version:
          type: string
        os_version:
          type: string
        locale:
          type: string
          examples:
          - en-US
        time_zone:
          type: string
          examples:
          - America/Chicago
      required:
      - platform
      - app_id
      - push_enabled
    Device:
      type: object
      properties:
        device_id:
          type: string
          description: Stable id your app generates once per install.
        member_id:
          type: string
          format: uuid
        platform:
          type: string
          enum:
          - ios
          - android
        push_token:
          type:
          - string
          - 'null'
          description: Null until the app has a token.
        token_type:
          type: string
          description: Required with `push_token`.
          enum:
          - fcm
          - apns
        app_id:
          type: string
          examples:
          - com.example.app
        push_enabled:
          type: boolean
          description: OS notification permission.
        app_version:
          type: string
        os_version:
          type: string
        locale:
          type: string
          examples:
          - en-US
        time_zone:
          type: string
          examples:
          - America/Chicago
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
      - device_id
      - member_id
      - platform
      - token_type
      - push_enabled
    MessageButton:
      type: object
      properties:
        label:
          type: string
        action:
          type: string
          enum:
          - open_screen
          - open_url
          - close
        url:
          type:
          - string
          - 'null'
    Message:
      type: object
      properties:
        id:
          type: string
          format: uuid
        layout:
          type: string
          enum:
          - full_image
          - image_and_text
        image_url:
          type: string
          format: uri
        title:
          type:
          - string
          - 'null'
        body:
          type:
          - string
          - 'null'
        primary:
          $ref: '#/components/schemas/MessageButton'
        secondary:
          oneOf:
          - $ref: '#/components/schemas/MessageButton'
          - type: 'null'
        offer:
          type:
          - object
          - 'null'
          properties:
            code:
              type:
              - string
              - 'null'
            wallet_item_id:
              type:
              - string
              - 'null'
              format: uuid
            text:
              type: string
        display:
          type: object
          properties:
            never_during:
              type: array
              items:
                type: string
              examples:
              - - checkout
        created_at:
          type: string
          format: date-time
        expires_at:
          type:
          - string
          - 'null'
          format: date-time
      required:
      - id
      - layout
      - primary
      - display
      - created_at
    MessageEventRequest:
      type: object
      properties:
        type:
          type: string
          enum:
          - impression
          - button_tap
          - close
        button:
          type: string
          enum:
          - primary
          - secondary
      required:
      - type
    PushOpenRequest:
      type: object
      properties:
        message_id:
          type: string
          format: uuid
        opened_at:
          type: string
          format: date-time
        button:
          type: string
          enum:
          - primary
          - secondary
      required:
      - message_id
      - opened_at
    AppEvent:
      type: object
      properties:
        event_id:
          type: string
          format: uuid
        name:
          type: string
          examples:
          - screen_viewed
        occurred_at:
          type: string
          format: date-time
        member_id:
          type: string
          format: uuid
        anonymous_id:
          type: string
        device_id:
          type: string
        session_id:
          type: string
        properties:
          type: object
          description: No personal data.
      required:
      - event_id
      - name
      - occurred_at
      - device_id
      - session_id
    AppEventBatch:
      type: object
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/AppEvent'
          minItems: 1
          maxItems: 100
      required:
      - events
    AppEventResult:
      type: object
      properties:
        accepted:
          type: integer
        duplicates:
          type: integer
    WebhookEndpoint:
      type: object
      properties:
        id:
          type: string
          format: uuid
        url:
          type: string
          format: uri
        description:
          type:
          - string
          - 'null'
          maxLength: 255
        event_types:
          type: array
          items:
            type: string
          description: Event types, or `["*"]` for all.
        status:
          type: string
          enum:
          - enabled
          - disabled
        secret:
          type: string
          description: '`whsec_` plus base64. Only on create and rotate_secret.'
          examples:
          - whsec_4cWtG7hYe5kSMHqAFDTiyxca6HNalvlQ
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
      required:
      - id
      - url
      - event_types
      - status
      - created_at
      - updated_at
    WebhookEndpointCreate:
      type: object
      properties:
        url:
          type: string
          description: HTTPS on a public hostname.
          format: uri
        event_types:
          type: array
          items:
            type: string
          minItems: 1
        description:
          type: string
          maxLength: 255
      required:
      - url
      - event_types
    WebhookEndpointUpdate:
      type: object
      properties:
        url:
          type: string
          format: uri
        event_types:
          type: array
          items:
            type: string
          minItems: 1
        description:
          type: string
          maxLength: 255
        status:
          type: string
          enum:
          - enabled
          - disabled
    RotateSecretRequest:
      type: object
      properties:
        expire_current_in_hours:
          type: integer
          description: Default 24. 0 stops the current secret now.
          minimum: 0
          default: 24
    Event:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: Same as the `webhook-id` header.
        type:
          type: string
          description: Event type. May grow.
          enum:
          - member.created
          - member.updated
          - member.deleted
          - points.changed
          - tier.changed
          - reward.issued
          - reward.redeemed
          - reward.expiring
          - order.credited
          - order.refunded
          - communication_preferences.updated
          - webhook.test
          - points.expiring
          - challenge.joined
          - challenge.progressed
          - challenge.completed
          - referral.completed
        created_at:
          type: string
          format: date-time
        api_version:
          type: string
          const: v1
        livemode:
          type: boolean
          description: False in the sandbox.
        brand_id:
          type: string
          format: uuid
        data:
          type: object
          properties:
            object:
              type: object
              description: Snapshot of the resource.
            previous_attributes:
              type: object
          required:
          - object
          - previous_attributes
      required:
      - id
      - type
      - created_at
      - api_version
      - livemode
      - brand_id
      - data
    Delivery:
      type: object
      properties:
        id:
          type: string
          format: uuid
        event_id:
          type: string
          format: uuid
        webhook_endpoint_id:
          type: string
          format: uuid
        attempt:
          type: integer
          minimum: 1
        status:
          type: string
          enum:
          - pending
          - succeeded
          - failed
        status_code:
          type:
          - integer
          - 'null'
        response_ms:
          type:
          - integer
          - 'null'
        error:
          type:
          - string
          - 'null'
          examples:
          - timeout
        attempted_at:
          type:
          - string
          - 'null'
          format: date-time
        next_retry_at:
          type:
          - string
          - 'null'
          format: date-time
      required:
      - id
      - event_id
      - webhook_endpoint_id
      - attempt
      - status
    RedeliverRequest:
      type: object
      properties:
        webhook_endpoint_id:
          type: string
          format: uuid
    ActivityEntryEvent:
      allOf:
      - $ref: '#/components/schemas/ActivityEntry'
      - type: object
        properties:
          member_id:
            type: string
            format: uuid
        required:
        - member_id
    WalletItemEvent:
      allOf:
      - $ref: '#/components/schemas/WalletItem'
      - type: object
        properties:
          member_id:
            type: string
            format: uuid
        required:
        - member_id
    DeletedMember:
      type: object
      properties:
        id:
          type: string
          format: uuid
        external_id:
          type:
          - string
          - 'null'
        status:
          type: string
          const: deleted
        deleted_at:
          type: string
          format: date-time
      required:
      - id
      - status
      - deleted_at
    TierChange:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        previous_tier:
          $ref: '#/components/schemas/TierRef'
        tier:
          $ref: '#/components/schemas/TierRef'
        direction:
          type: string
          enum:
          - up
          - down
      required:
      - member_id
      - previous_tier
      - tier
      - direction
    CommunicationPreferencesEvent:
      allOf:
      - $ref: '#/components/schemas/CommunicationPreferences'
      - type: object
        properties:
          member_id:
            type: string
            format: uuid
        required:
        - member_id
    PointsExpiring:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        points:
          type: integer
        points_balance:
          type: integer
        last_activity_at:
          type: string
          format: date-time
        expires_at:
          type: string
          format: date-time
      description: Coming soon.
    ReferralCompleted:
      type: object
      properties:
        id:
          type: string
          format: uuid
        referrer_member_id:
          type: string
          format: uuid
        referred_member_id:
          type: string
          format: uuid
        qualifying_order_id:
          type:
          - string
          - 'null'
          format: uuid
        completed_at:
          type: string
          format: date-time
      description: Coming soon.
    WebhookTest:
      type: object
      properties:
        webhook_endpoint_id:
          type: string
          format: uuid
        message:
          type: string
    TestInStoreOrderRequest:
      type: object
      properties:
        member_id:
          type: string
          format: uuid
        location_id:
          type: string
          format: uuid
        subtotal_cents:
          type: integer
          description: Integer cents.
          minimum: 0
      required:
      - member_id
      - location_id
      - subtotal_cents
    TestWalletRequest:
      type: object
      properties:
        reward_id:
          type: string
          format: uuid
      required:
      - reward_id
    TestWebhookRequest:
      type: object
      properties:
        type:
          type: string
          description: Event type. May grow.
          enum:
          - member.created
          - member.updated
          - member.deleted
          - points.changed
          - tier.changed
          - reward.issued
          - reward.redeemed
          - reward.expiring
          - order.credited
          - order.refunded
          - communication_preferences.updated
          - webhook.test
          - points.expiring
          - challenge.joined
          - challenge.progressed
          - challenge.completed
          - referral.completed
      required:
      - type
    HostedTokenResponse:
      type: object
      properties:
        access_token:
          type: string
          description: A member token, `mt_...`.
        token_type:
          type: string
          const: Bearer
        expires_in:
          type: integer
          examples:
          - 900
        refresh_token:
          type: string
          description: Rotates on every use.
        member_id:
          type: string
          format: uuid
      description: Coming soon.