API reference

GET /api/v1/me #

The organisation, the plan and this key's permissions.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

Example call

curl "https://passavo.eu/api/v1/me" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/me');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/me', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/me", headers=headers)
data = response.json()["data"]

Responses

• 200 — The organisation, the plan and this key's permissions.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "organisation": {},
        "plan": {},
        "api_key": {
            "name": "string",
            "prefix": "string",
            "mode": "live",
            "scopes": [
                "read"
            ],
            "expires_at": "2026-09-21T14:00:00+02:00",
            "last_used_at": "2026-09-21T14:00:00+02:00"
        },
        "locale": "string",
        "version": "string"
    }
}

GET /api/v1/events #

The events and series, by date.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: event_date, -event_date, created_at, -created_at, sort_order, -sort_order, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[type] string · in the url · optional

  Filter on type.

• filter[from] string · in the url · optional

  Filter on from.

• filter[to] string · in the url · optional

  Filter on to.

• include string · in the url · optional

  Include these relations: venue.

  Values: venue

Example call

curl "https://passavo.eu/api/v1/events" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/events');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/events', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/events", headers=headers)
data = response.json()["data"]

Responses

• 200 — The events and series, by date.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "type": "string",
            "name": "string",
            "description": "string",
            "translations": {},
            "sku": "string",
            "venue_id": 1,
            "vat_rate_bp": 1,
            "capacity_rules": {},
            "event_date": "2026-09-21",
            "requires_slot": true,
            "supports_slot": true,
            "is_active": true,
            "sort_order": 1,
            "prices": [
                {
                    "id": 1,
                    "channel": "string",
                    "label": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_from": "2026-09-21",
                    "valid_until": "2026-09-21"
                }
            ],
            "venue": {
                "id": 1,
                "name": "string",
                "slug": "string",
                "address": {},
                "latitude": 1,
                "longitude": 1,
                "timezone": "string",
                "opening_hours": {},
                "is_active": true,
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            },
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/products #

The products with their prices.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, sort_order, -sort_order, event_date, -event_date, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[type] string · in the url · optional

  Filter on type.

• filter[venue_id] string · in the url · optional

  Filter on venue_id.

• include string · in the url · optional

  Include these relations: venue.

  Values: venue

Example call

curl "https://passavo.eu/api/v1/products" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/products');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/products', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/products", headers=headers)
data = response.json()["data"]

Responses

• 200 — The products with their prices.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "type": "string",
            "name": "string",
            "description": "string",
            "translations": {},
            "sku": "string",
            "venue_id": 1,
            "vat_rate_bp": 1,
            "capacity_rules": {},
            "event_date": "2026-09-21",
            "requires_slot": true,
            "supports_slot": true,
            "is_active": true,
            "sort_order": 1,
            "prices": [
                {
                    "id": 1,
                    "channel": "string",
                    "label": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_from": "2026-09-21",
                    "valid_until": "2026-09-21"
                }
            ],
            "venue": {
                "id": 1,
                "name": "string",
                "slug": "string",
                "address": {},
                "latitude": 1,
                "longitude": 1,
                "timezone": "string",
                "opening_hours": {},
                "is_active": true,
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            },
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/products/{id} #

A single product.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The product's id.

• include string · in the url · optional

  Include these relations: venue.

  Values: venue

Example call

curl "https://passavo.eu/api/v1/products/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/products/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/products/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/products/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — A single product.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "type": "string",
        "name": "string",
        "description": "string",
        "translations": {},
        "sku": "string",
        "venue_id": 1,
        "vat_rate_bp": 1,
        "capacity_rules": {},
        "event_date": "2026-09-21",
        "requires_slot": true,
        "supports_slot": true,
        "is_active": true,
        "sort_order": 1,
        "prices": [
            {
                "id": 1,
                "channel": "string",
                "label": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_from": "2026-09-21",
                "valid_until": "2026-09-21"
            }
        ],
        "venue": {
            "id": 1,
            "name": "string",
            "slug": "string",
            "address": {},
            "latitude": 1,
            "longitude": 1,
            "timezone": "string",
            "opening_hours": {},
            "is_active": true,
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        },
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/venues #

The organisation's locations.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, name, -name, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• include string · in the url · optional

  Include these relations: products.

  Values: products

Example call

curl "https://passavo.eu/api/v1/venues" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/venues');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/venues', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/venues", headers=headers)
data = response.json()["data"]

Responses

• 200 — The organisation's locations.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "name": "string",
            "slug": "string",
            "address": {},
            "latitude": 1,
            "longitude": 1,
            "timezone": "string",
            "opening_hours": {},
            "is_active": true,
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/venues/{id} #

A single location.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The location's id.

Example call

curl "https://passavo.eu/api/v1/venues/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/venues/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/venues/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/venues/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — A single location.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "name": "string",
        "slug": "string",
        "address": {},
        "latitude": 1,
        "longitude": 1,
        "timezone": "string",
        "opening_hours": {},
        "is_active": true,
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/products/{id}/slots #

A product's time slots, with the free places.

Right needed: read

Parameters

• id integer · in the path · required

  The product's id.

• from string · in the url · optional

  Start of the window; today by default.

• to string · in the url · optional

  End of the window; 31 days later by default.

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: starts_at, -starts_at, created_at, -created_at, id, -id

• filter[status] string · in the url · optional

  Filter on status.

Example call

curl "https://passavo.eu/api/v1/products/12/slots" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/products/12/slots');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/products/12/slots', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/products/12/slots", headers=headers)
data = response.json()["data"]

Responses

• 200 — A product's time slots, with the free places.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "product_id": 1,
            "venue_id": 1,
            "starts_at": "2026-09-21T14:00:00+02:00",
            "ends_at": "2026-09-21T14:00:00+02:00",
            "status": "string",
            "availability": {
                "capacity": 1,
                "sold": 1,
                "free": 1,
                "bookable_online": true,
                "started": true
            },
            "note": "string"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/discounts #

The discount codes.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, code, -code, valid_until, -valid_until, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[type] string · in the url · optional

  Filter on type.

• filter[code] string · in the url · optional

  Filter on code.

Example call

curl "https://passavo.eu/api/v1/discounts" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/discounts');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/discounts', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/discounts", headers=headers)
data = response.json()["data"]

Responses

• 200 — The discount codes.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "code": "string",
            "type": "percent",
            "value": 1,
            "amount": {},
            "percentage_bp": 1,
            "valid_from": "2026-09-21T14:00:00+02:00",
            "valid_until": "2026-09-21T14:00:00+02:00",
            "max_redemptions": 1,
            "max_redemptions_per_customer": 1,
            "redeemed_count": 1,
            "minimum_order": {},
            "product_ids": [
                1
            ],
            "is_active": true,
            "is_redeemable": true,
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/passes #

The season passes.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, valid_until, -valid_until, valid_from, -valid_from, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[product_id] string · in the url · optional

  Filter on product_id.

• include string · in the url · optional

  Include these relations: product.

  Values: product

Example call

curl "https://passavo.eu/api/v1/passes" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/passes');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/passes', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/passes", headers=headers)
data = response.json()["data"]

Responses

• 200 — The season passes.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
            "product_id": 1,
            "holder_name": "string",
            "holder_email": "string",
            "valid_from": "2026-09-21",
            "valid_until": "2026-09-21",
            "status": "string",
            "is_usable": true,
            "visit_count": 1,
            "last_visit_at": "2026-09-21T14:00:00+02:00",
            "cancelled_at": "2026-09-21T14:00:00+02:00",
            "product": {
                "id": 1,
                "type": "string",
                "name": "string",
                "description": "string",
                "translations": {},
                "sku": "string",
                "venue_id": 1,
                "vat_rate_bp": 1,
                "capacity_rules": {},
                "event_date": "2026-09-21",
                "requires_slot": true,
                "supports_slot": true,
                "is_active": true,
                "sort_order": 1,
                "prices": [
                    {
                        "id": 1,
                        "channel": "string",
                        "label": "string",
                        "amount": {
                            "amount_cent": null,
                            "currency": null
                        },
                        "valid_from": "2026-09-21",
                        "valid_until": "2026-09-21"
                    }
                ],
                "venue": {
                    "id": 1,
                    "name": "string",
                    "slug": "string",
                    "address": {},
                    "latitude": 1,
                    "longitude": 1,
                    "timezone": "string",
                    "opening_hours": {},
                    "is_active": true,
                    "created_at": "2026-09-21T14:00:00+02:00",
                    "updated_at": "2026-09-21T14:00:00+02:00"
                },
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            },
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

POST /api/v1/passes #

Issue a season pass in someone's name.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

Example call

curl -X POST "https://passavo.eu/api/v1/passes" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/passes', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/passes', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/passes", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Issue a season pass in someone's name.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "product_id": 1,
        "holder_name": "string",
        "holder_email": "string",
        "valid_from": "2026-09-21",
        "valid_until": "2026-09-21",
        "status": "string",
        "is_usable": true,
        "visit_count": 1,
        "last_visit_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "product": {
            "id": 1,
            "type": "string",
            "name": "string",
            "description": "string",
            "translations": {},
            "sku": "string",
            "venue_id": 1,
            "vat_rate_bp": 1,
            "capacity_rules": {},
            "event_date": "2026-09-21",
            "requires_slot": true,
            "supports_slot": true,
            "is_active": true,
            "sort_order": 1,
            "prices": [
                {
                    "id": 1,
                    "channel": "string",
                    "label": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_from": "2026-09-21",
                    "valid_until": "2026-09-21"
                }
            ],
            "venue": {
                "id": 1,
                "name": "string",
                "slug": "string",
                "address": {},
                "latitude": 1,
                "longitude": 1,
                "timezone": "string",
                "opening_hours": {},
                "is_active": true,
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            },
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        },
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/passes/{id}/renew #

Renew a season pass; this creates a new pass.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The season pass's uuid.

Example call

curl -X POST "https://passavo.eu/api/v1/passes/12/renew" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/passes/12/renew', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/passes/12/renew', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/passes/12/renew", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Renew a season pass; this creates a new pass.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "product_id": 1,
        "holder_name": "string",
        "holder_email": "string",
        "valid_from": "2026-09-21",
        "valid_until": "2026-09-21",
        "status": "string",
        "is_usable": true,
        "visit_count": 1,
        "last_visit_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "product": {
            "id": 1,
            "type": "string",
            "name": "string",
            "description": "string",
            "translations": {},
            "sku": "string",
            "venue_id": 1,
            "vat_rate_bp": 1,
            "capacity_rules": {},
            "event_date": "2026-09-21",
            "requires_slot": true,
            "supports_slot": true,
            "is_active": true,
            "sort_order": 1,
            "prices": [
                {
                    "id": 1,
                    "channel": "string",
                    "label": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_from": "2026-09-21",
                    "valid_until": "2026-09-21"
                }
            ],
            "venue": {
                "id": 1,
                "name": "string",
                "slug": "string",
                "address": {},
                "latitude": 1,
                "longitude": 1,
                "timezone": "string",
                "opening_hours": {},
                "is_active": true,
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            },
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        },
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/vouchers #

Issue a gift voucher.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

Example call

curl -X POST "https://passavo.eu/api/v1/vouchers" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/vouchers', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/vouchers', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/vouchers", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Issue a gift voucher.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "code": "string",
        "balance": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "initial_balance": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "currency": "string",
        "status": "string",
        "is_redeemable": true,
        "expires_at": "2026-09-21",
        "recipient_name": "string",
        "is_active": true,
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/vouchers/{code} #

The balance of a single gift voucher.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• code string · in the path · required

  The gift voucher's code.

Example call

curl "https://passavo.eu/api/v1/vouchers/BON-1234" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/vouchers/BON-1234');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/vouchers/BON-1234', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/vouchers/BON-1234", headers=headers)
data = response.json()["data"]

Responses

• 200 — The balance of a single gift voucher.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "code": "string",
        "balance": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "initial_balance": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "currency": "string",
        "status": "string",
        "is_redeemable": true,
        "expires_at": "2026-09-21",
        "recipient_name": "string",
        "is_active": true,
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/vouchers/{code}/redeem #

Deduct part of a gift voucher.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• code string · in the path · required

  The gift voucher's code.

Example call

curl -X POST "https://passavo.eu/api/v1/vouchers/BON-1234/redeem" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/vouchers/BON-1234/redeem', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/vouchers/BON-1234/redeem', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/vouchers/BON-1234/redeem", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Deduct part of a gift voucher.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "code": "string",
        "requested": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "redeemed": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "balance": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "is_redeemable": true
    }
}

GET /api/v1/orders #

The organisation's orders.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, paid_at, -paid_at, total_cent, -total_cent, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[channel] string · in the url · optional

  Filter on channel.

• filter[reference] string · in the url · optional

  Filter on reference.

• filter[email] string · in the url · optional

  Filter on email.

• filter[from] string · in the url · optional

  Filter on from.

• filter[to] string · in the url · optional

  Filter on to.

• filter[sandbox] string · in the url · optional

  Filter on sandbox.

• include string · in the url · optional

  Include these relations: lines, tickets, payments, refunds.

  Values: lines, tickets, payments, refunds

Example call

curl "https://passavo.eu/api/v1/orders" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/orders');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/orders", headers=headers)
data = response.json()["data"]

Responses

• 200 — The organisation's orders.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": "string",
            "reference": "string",
            "status": "draft",
            "channel": "online",
            "venue_id": 1,
            "buyer": {
                "name": "string",
                "email": "string",
                "phone": "string",
                "locale": "string"
            },
            "totals": {
                "subtotal": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "discount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "discount_code": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "voucher": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                }
            },
            "discount_code": "string",
            "voucher_code": "string",
            "reserved_until": "2026-09-21T14:00:00+02:00",
            "sandbox": true,
            "test": true,
            "payment": {
                "provider": "string",
                "provider_ref": "string",
                "redirect_url": "string",
                "qr_code_url": "string"
            },
            "paid_at": "2026-09-21T14:00:00+02:00",
            "cancelled_at": "2026-09-21T14:00:00+02:00",
            "lines": [
                {
                    "id": 1,
                    "product_id": 1,
                    "slot_id": 1,
                    "description": "string",
                    "quantity": 1,
                    "unit_price": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "line_total": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "vat_rate_bp": 1,
                    "vat": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_on": "2026-09-21",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "tickets": [
                {
                    "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                    "order_line_id": 1,
                    "order_id": "string",
                    "product_id": 1,
                    "slot_id": 1,
                    "description": "string",
                    "holder_name": "string",
                    "status": "valid",
                    "valid_on": "2026-09-21",
                    "is_scannable": true,
                    "used_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00",
                    "updated_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "payments": [
                {
                    "id": 1,
                    "provider": "string",
                    "provider_ref": "string",
                    "method": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "status": "string",
                    "paid_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "refunds": [
                {
                    "id": 1,
                    "payment_id": 1,
                    "provider": "string",
                    "provider_ref": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "status": "pending",
                    "reason": "string",
                    "refunded_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

POST /api/v1/orders #

A new order, with the places held.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · required

  Required. Without this key, a retry after a network error can create a second order or a second voucher.

Example call

curl -X POST "https://passavo.eu/api/v1/orders" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/orders', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/orders", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — A new order, with the places held.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The time slot is full or has already started.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "string",
        "reference": "string",
        "status": "draft",
        "channel": "online",
        "venue_id": 1,
        "buyer": {
            "name": "string",
            "email": "string",
            "phone": "string",
            "locale": "string"
        },
        "totals": {
            "subtotal": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount_code": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "voucher": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "vat": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "total": {
                "amount_cent": 1,
                "currency": "EUR"
            }
        },
        "discount_code": "string",
        "voucher_code": "string",
        "reserved_until": "2026-09-21T14:00:00+02:00",
        "sandbox": true,
        "test": true,
        "payment": {
            "provider": "string",
            "provider_ref": "string",
            "redirect_url": "string",
            "qr_code_url": "string"
        },
        "paid_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "lines": [
            {
                "id": 1,
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "quantity": 1,
                "unit_price": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "line_total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat_rate_bp": 1,
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_on": "2026-09-21",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "tickets": [
            {
                "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                "order_line_id": 1,
                "order_id": "string",
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "holder_name": "string",
                "status": "valid",
                "valid_on": "2026-09-21",
                "is_scannable": true,
                "used_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "payments": [
            {
                "id": 1,
                "provider": "string",
                "provider_ref": "string",
                "method": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "string",
                "paid_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "refunds": [
            {
                "id": 1,
                "payment_id": 1,
                "provider": "string",
                "provider_ref": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "pending",
                "reason": "string",
                "refunded_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/orders/{id} #

A single order.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

• include string · in the url · optional

  Include these relations: lines, tickets, payments, refunds.

  Values: lines, tickets, payments, refunds

Example call

curl "https://passavo.eu/api/v1/orders/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/orders/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/orders/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — A single order.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "string",
        "reference": "string",
        "status": "draft",
        "channel": "online",
        "venue_id": 1,
        "buyer": {
            "name": "string",
            "email": "string",
            "phone": "string",
            "locale": "string"
        },
        "totals": {
            "subtotal": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount_code": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "voucher": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "vat": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "total": {
                "amount_cent": 1,
                "currency": "EUR"
            }
        },
        "discount_code": "string",
        "voucher_code": "string",
        "reserved_until": "2026-09-21T14:00:00+02:00",
        "sandbox": true,
        "test": true,
        "payment": {
            "provider": "string",
            "provider_ref": "string",
            "redirect_url": "string",
            "qr_code_url": "string"
        },
        "paid_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "lines": [
            {
                "id": 1,
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "quantity": 1,
                "unit_price": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "line_total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat_rate_bp": 1,
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_on": "2026-09-21",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "tickets": [
            {
                "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                "order_line_id": 1,
                "order_id": "string",
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "holder_name": "string",
                "status": "valid",
                "valid_on": "2026-09-21",
                "is_scannable": true,
                "used_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "payments": [
            {
                "id": 1,
                "provider": "string",
                "provider_ref": "string",
                "method": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "string",
                "paid_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "refunds": [
            {
                "id": 1,
                "payment_id": 1,
                "provider": "string",
                "provider_ref": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "pending",
                "reason": "string",
                "refunded_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/orders/{id}/cancel #

Cancel and give the places back.

Right needed: write

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

Example call

curl -X POST "https://passavo.eu/api/v1/orders/12/cancel" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/orders/12/cancel');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12/cancel', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/orders/12/cancel", headers=headers)
data = response.json()["data"]

Responses

• 200 — Cancel and give the places back.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This order cannot be cancelled.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "string",
        "reference": "string",
        "status": "draft",
        "channel": "online",
        "venue_id": 1,
        "buyer": {
            "name": "string",
            "email": "string",
            "phone": "string",
            "locale": "string"
        },
        "totals": {
            "subtotal": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount_code": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "voucher": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "vat": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "total": {
                "amount_cent": 1,
                "currency": "EUR"
            }
        },
        "discount_code": "string",
        "voucher_code": "string",
        "reserved_until": "2026-09-21T14:00:00+02:00",
        "sandbox": true,
        "test": true,
        "payment": {
            "provider": "string",
            "provider_ref": "string",
            "redirect_url": "string",
            "qr_code_url": "string"
        },
        "paid_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "lines": [
            {
                "id": 1,
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "quantity": 1,
                "unit_price": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "line_total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat_rate_bp": 1,
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_on": "2026-09-21",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "tickets": [
            {
                "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                "order_line_id": 1,
                "order_id": "string",
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "holder_name": "string",
                "status": "valid",
                "valid_on": "2026-09-21",
                "is_scannable": true,
                "used_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "payments": [
            {
                "id": 1,
                "provider": "string",
                "provider_ref": "string",
                "method": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "string",
                "paid_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "refunds": [
            {
                "id": 1,
                "payment_id": 1,
                "provider": "string",
                "provider_ref": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "pending",
                "reason": "string",
                "refunded_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/orders/{id}/checkout #

The payment link from the connected provider.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

Example call

curl -X POST "https://passavo.eu/api/v1/orders/12/checkout" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/orders/12/checkout', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12/checkout', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/orders/12/checkout", headers=headers, json={})
data = response.json()["data"]

Responses

• 200 — The payment link from the connected provider.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This organisation has no payment provider connected.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "string",
        "reference": "string",
        "status": "draft",
        "channel": "online",
        "venue_id": 1,
        "buyer": {
            "name": "string",
            "email": "string",
            "phone": "string",
            "locale": "string"
        },
        "totals": {
            "subtotal": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount_code": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "voucher": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "vat": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "total": {
                "amount_cent": 1,
                "currency": "EUR"
            }
        },
        "discount_code": "string",
        "voucher_code": "string",
        "reserved_until": "2026-09-21T14:00:00+02:00",
        "sandbox": true,
        "test": true,
        "payment": {
            "provider": "string",
            "provider_ref": "string",
            "redirect_url": "string",
            "qr_code_url": "string"
        },
        "paid_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "lines": [
            {
                "id": 1,
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "quantity": 1,
                "unit_price": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "line_total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat_rate_bp": 1,
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_on": "2026-09-21",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "tickets": [
            {
                "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                "order_line_id": 1,
                "order_id": "string",
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "holder_name": "string",
                "status": "valid",
                "valid_on": "2026-09-21",
                "is_scannable": true,
                "used_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "payments": [
            {
                "id": 1,
                "provider": "string",
                "provider_ref": "string",
                "method": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "string",
                "paid_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "refunds": [
            {
                "id": 1,
                "payment_id": 1,
                "provider": "string",
                "provider_ref": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "pending",
                "reason": "string",
                "refunded_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/orders/{id}/invoice-request #

Ask for an invoice in someone's name.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

Example call

curl -X POST "https://passavo.eu/api/v1/orders/12/invoice-request" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/orders/12/invoice-request', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12/invoice-request', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/orders/12/invoice-request", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Ask for an invoice in someone's name.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "order_id": "string",
        "requested_at": "2026-09-21T14:00:00+02:00",
        "company_name": "string",
        "vat_number": "string",
        "vat_number_valid": true,
        "country": "string",
        "invoice_number": "string"
    }
}

POST /api/v1/orders/{id}/mark-paid #

Paid outside the provider (transfer, cash).

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

Example call

curl -X POST "https://passavo.eu/api/v1/orders/12/mark-paid" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/orders/12/mark-paid', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12/mark-paid', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/orders/12/mark-paid", headers=headers, json={})
data = response.json()["data"]

Responses

• 200 — Paid outside the provider (transfer, cash).
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "string",
        "reference": "string",
        "status": "draft",
        "channel": "online",
        "venue_id": 1,
        "buyer": {
            "name": "string",
            "email": "string",
            "phone": "string",
            "locale": "string"
        },
        "totals": {
            "subtotal": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "discount_code": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "voucher": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "vat": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "total": {
                "amount_cent": 1,
                "currency": "EUR"
            }
        },
        "discount_code": "string",
        "voucher_code": "string",
        "reserved_until": "2026-09-21T14:00:00+02:00",
        "sandbox": true,
        "test": true,
        "payment": {
            "provider": "string",
            "provider_ref": "string",
            "redirect_url": "string",
            "qr_code_url": "string"
        },
        "paid_at": "2026-09-21T14:00:00+02:00",
        "cancelled_at": "2026-09-21T14:00:00+02:00",
        "lines": [
            {
                "id": 1,
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "quantity": 1,
                "unit_price": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "line_total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat_rate_bp": 1,
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "valid_on": "2026-09-21",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "tickets": [
            {
                "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                "order_line_id": 1,
                "order_id": "string",
                "product_id": 1,
                "slot_id": 1,
                "description": "string",
                "holder_name": "string",
                "status": "valid",
                "valid_on": "2026-09-21",
                "is_scannable": true,
                "used_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00",
                "updated_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "payments": [
            {
                "id": 1,
                "provider": "string",
                "provider_ref": "string",
                "method": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "string",
                "paid_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "refunds": [
            {
                "id": 1,
                "payment_id": 1,
                "provider": "string",
                "provider_ref": "string",
                "amount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "status": "pending",
                "reason": "string",
                "refunded_at": "2026-09-21T14:00:00+02:00",
                "created_at": "2026-09-21T14:00:00+02:00"
            }
        ],
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/orders/{id}/refund #

Refund in full or in part.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

Example call

curl -X POST "https://passavo.eu/api/v1/orders/12/refund" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/orders/12/refund', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/orders/12/refund', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/orders/12/refund", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Refund in full or in part.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — There is nothing (left) to refund.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "payment_id": 1,
        "provider": "string",
        "provider_ref": "string",
        "amount": {
            "amount_cent": 1,
            "currency": "EUR"
        },
        "status": "pending",
        "reason": "string",
        "refunded_at": "2026-09-21T14:00:00+02:00",
        "created_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/sandbox/payments/{reference} #

The simulated payment page of the sandbox.

Right needed: No key needed

Parameters

• reference string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

• signature string · in the url · optional

  The signature from the link; do not change it.

• expires integer · in the url · optional

  When the link expires, as a timestamp.

• return_url string · in the url · optional

  Where the buyer goes afterwards.

Example call

curl "https://passavo.eu/api/v1/sandbox/payments/12" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->get('https://passavo.eu/api/v1/sandbox/payments/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/sandbox/payments/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json"}
response = requests.get("https://passavo.eu/api/v1/sandbox/payments/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — The simulated payment page of the sandbox.
• 302 — Back to the integration's return_url.
• 403 — This link is not valid or has expired.
• 404 — Not found.

POST /api/v1/sandbox/payments/{reference} #

Settle the simulated payment.

Right needed: No key needed

Parameters

• reference string · in the path · required

  The order's reference, e.g. ORD-AB12CD34EF.

• signature string · in the url · optional

  The signature from the link; do not change it.

• expires integer · in the url · optional

  When the link expires, as a timestamp.

• return_url string · in the url · optional

  Where the buyer goes afterwards.

Example call

curl -X POST "https://passavo.eu/api/v1/sandbox/payments/12" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->post('https://passavo.eu/api/v1/sandbox/payments/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/sandbox/payments/12', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json"}
response = requests.post("https://passavo.eu/api/v1/sandbox/payments/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — Settle the simulated payment.
• 302 — Back to the integration's return_url.
• 403 — This link is not valid or has expired.
• 404 — Not found.

GET /api/v1/tickets #

The tickets, with filters for the door list.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, valid_on, -valid_on, used_at, -used_at, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[valid_on] string · in the url · optional

  Filter on valid_on.

• filter[product_id] string · in the url · optional

  Filter on product_id.

• filter[order] string · in the url · optional

  Filter on order.

• filter[from] string · in the url · optional

  Filter on from.

• filter[to] string · in the url · optional

  Filter on to.

Example call

curl "https://passavo.eu/api/v1/tickets" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/tickets');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/tickets", headers=headers)
data = response.json()["data"]

Responses

• 200 — The tickets, with filters for the door list.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
            "order_line_id": 1,
            "order_id": "string",
            "product_id": 1,
            "slot_id": 1,
            "description": "string",
            "holder_name": "string",
            "status": "valid",
            "valid_on": "2026-09-21",
            "is_scannable": true,
            "used_at": "2026-09-21T14:00:00+02:00",
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/tickets/{uuid} #

A single ticket.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• uuid string · in the path · required

  The ticket's uuid.

Example call

curl "https://passavo.eu/api/v1/tickets/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/tickets/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/tickets/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — A single ticket.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "order_line_id": 1,
        "order_id": "string",
        "product_id": 1,
        "slot_id": 1,
        "description": "string",
        "holder_name": "string",
        "status": "valid",
        "valid_on": "2026-09-21",
        "is_scannable": true,
        "used_at": "2026-09-21T14:00:00+02:00",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/tickets/{uuid}/pdf #

A signed link to the pdf with the tickets.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• uuid string · in the path · required

  The ticket's uuid.

Example call

curl "https://passavo.eu/api/v1/tickets/12/pdf" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/tickets/12/pdf');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets/12/pdf', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/tickets/12/pdf", headers=headers)
data = response.json()["data"]

Responses

• 200 — A signed link to the pdf with the tickets.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "order_id": "string",
        "url": "https://passavo.eu",
        "expires_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/tickets/{uuid}/resend #

Send the confirmation mail again.

Right needed: write

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• uuid string · in the path · required

  The ticket's uuid.

Example call

curl -X POST "https://passavo.eu/api/v1/tickets/12/resend" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/tickets/12/resend');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets/12/resend', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/tickets/12/resend", headers=headers)
data = response.json()["data"]

Responses

• 200 — Send the confirmation mail again.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "order_id": "string",
        "sent_to": "string"
    }
}

POST /api/v1/tickets/{uuid}/void #

Make the ticket invalid.

Right needed: write

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• uuid string · in the path · required

  The ticket's uuid.

Example call

curl -X POST "https://passavo.eu/api/v1/tickets/12/void" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/tickets/12/void');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets/12/void', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/tickets/12/void", headers=headers)
data = response.json()["data"]

Responses

• 200 — Make the ticket invalid.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "order_line_id": 1,
        "order_id": "string",
        "product_id": 1,
        "slot_id": 1,
        "description": "string",
        "holder_name": "string",
        "status": "valid",
        "valid_on": "2026-09-21",
        "is_scannable": true,
        "used_at": "2026-09-21T14:00:00+02:00",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/tickets/{uuid}/wallet #

Signed links to the wallet passes.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• uuid string · in the path · required

  The ticket's uuid.

Example call

curl "https://passavo.eu/api/v1/tickets/12/wallet" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/tickets/12/wallet');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/tickets/12/wallet', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/tickets/12/wallet", headers=headers)
data = response.json()["data"]

Responses

• 200 — Signed links to the wallet passes.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "apple_url": "https://passavo.eu",
        "google_url": "https://passavo.eu",
        "expires_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/check-ins #

The check-ins at the entrance.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: scanned_at, -scanned_at, created_at, -created_at, id, -id

• filter[result] string · in the url · optional

  Filter on result.

• filter[from] string · in the url · optional

  Filter on from.

• filter[to] string · in the url · optional

  Filter on to.

• filter[ticket] string · in the url · optional

  Filter on ticket.

Example call

curl "https://passavo.eu/api/v1/check-ins" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/check-ins');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/check-ins', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/check-ins", headers=headers)
data = response.json()["data"]

Responses

• 200 — The check-ins at the entrance.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "result": "ok",
            "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
            "pass_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
            "scanned_at": "2026-09-21T14:00:00+02:00",
            "undone_at": "2026-09-21T14:00:00+02:00",
            "by": {
                "type": "api_key",
                "name": "string"
            },
            "created_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

POST /api/v1/check-ins #

Let someone in.

Right needed: write

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

Example call

curl -X POST "https://passavo.eu/api/v1/check-ins" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/check-ins', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/check-ins', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/check-ins", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Let someone in.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This code has already been checked in.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "result": "ok",
        "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "pass_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "scanned_at": "2026-09-21T14:00:00+02:00",
        "undone_at": "2026-09-21T14:00:00+02:00",
        "by": {
            "type": "api_key",
            "name": "string"
        },
        "created_at": "2026-09-21T14:00:00+02:00"
    }
}

DELETE /api/v1/check-ins/{id} #

Undo a check-in.

Right needed: write

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• Idempotency-Key string · as a header · optional

  Repeat a call safely: the same key with the same content returns the same answer.

• id integer · in the path · required

  The check-in's id.

Example call

curl -X DELETE "https://passavo.eu/api/v1/check-ins/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->delete('https://passavo.eu/api/v1/check-ins/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/check-ins/12', {
  method: 'DELETE',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.delete("https://passavo.eu/api/v1/check-ins/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — Undo a check-in.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — The order is not in a state that allows this.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "result": "ok",
        "ticket_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "pass_id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
        "scanned_at": "2026-09-21T14:00:00+02:00",
        "undone_at": "2026-09-21T14:00:00+02:00",
        "by": {
            "type": "api_key",
            "name": "string"
        },
        "created_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/customers #

The buyers, summarised per email address.

Right needed: read

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: last_order_at, -last_order_at

• filter[email] string · in the url · optional

  Filter on email.

• filter[search] string · in the url · optional

  Filter on search.

Example call

curl "https://passavo.eu/api/v1/customers" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/customers');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/customers', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/customers", headers=headers)
data = response.json()["data"]

Responses

• 200 — The buyers, summarised per email address.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": "string",
            "email": "string",
            "name": "string",
            "orders": 1,
            "spent": {
                "amount_cent": 1,
                "currency": "EUR"
            },
            "first_order_at": "2026-09-21T14:00:00+02:00",
            "last_order_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/customers/{email}/orders #

The orders for a single email address.

Right needed: read

Parameters

• email string · in the path · required

  The buyer's email address, url-encoded.

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, paid_at, -paid_at, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• include string · in the url · optional

  Include these relations: lines, tickets, payments, refunds.

  Values: lines, tickets, payments, refunds

Example call

curl "https://passavo.eu/api/v1/customers/12/orders" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/customers/12/orders');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/customers/12/orders', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/customers/12/orders", headers=headers)
data = response.json()["data"]

Responses

• 200 — The orders for a single email address.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": "string",
            "reference": "string",
            "status": "draft",
            "channel": "online",
            "venue_id": 1,
            "buyer": {
                "name": "string",
                "email": "string",
                "phone": "string",
                "locale": "string"
            },
            "totals": {
                "subtotal": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "discount": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "discount_code": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "voucher": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "vat": {
                    "amount_cent": 1,
                    "currency": "EUR"
                },
                "total": {
                    "amount_cent": 1,
                    "currency": "EUR"
                }
            },
            "discount_code": "string",
            "voucher_code": "string",
            "reserved_until": "2026-09-21T14:00:00+02:00",
            "sandbox": true,
            "test": true,
            "payment": {
                "provider": "string",
                "provider_ref": "string",
                "redirect_url": "string",
                "qr_code_url": "string"
            },
            "paid_at": "2026-09-21T14:00:00+02:00",
            "cancelled_at": "2026-09-21T14:00:00+02:00",
            "lines": [
                {
                    "id": 1,
                    "product_id": 1,
                    "slot_id": 1,
                    "description": "string",
                    "quantity": 1,
                    "unit_price": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "line_total": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "vat_rate_bp": 1,
                    "vat": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "valid_on": "2026-09-21",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "tickets": [
                {
                    "id": "9f1c0b4a-6b2f-4a1b-9c7e-1f2d3e4a5b6c",
                    "order_line_id": 1,
                    "order_id": "string",
                    "product_id": 1,
                    "slot_id": 1,
                    "description": "string",
                    "holder_name": "string",
                    "status": "valid",
                    "valid_on": "2026-09-21",
                    "is_scannable": true,
                    "used_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00",
                    "updated_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "payments": [
                {
                    "id": 1,
                    "provider": "string",
                    "provider_ref": "string",
                    "method": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "status": "string",
                    "paid_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "refunds": [
                {
                    "id": 1,
                    "payment_id": 1,
                    "provider": "string",
                    "provider_ref": "string",
                    "amount": {
                        "amount_cent": 1,
                        "currency": "EUR"
                    },
                    "status": "pending",
                    "reason": "string",
                    "refunded_at": "2026-09-21T14:00:00+02:00",
                    "created_at": "2026-09-21T14:00:00+02:00"
                }
            ],
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/openapi.json #

The description of this API.

Right needed: No key needed

Example call

curl "https://passavo.eu/api/v1/openapi.json" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->get('https://passavo.eu/api/v1/openapi.json');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/openapi.json', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json"}
response = requests.get("https://passavo.eu/api/v1/openapi.json", headers=headers)
data = response.json()["data"]

Responses

• 200 — The description of this API.

Example response

{}

GET /api/v1/webhook-deliveries #

The delivery log of the last thirty days.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, id, -id

• filter[endpoint] string · in the url · optional

  Filter on endpoint.

• filter[status] string · in the url · optional

  Filter on status.

• filter[event] string · in the url · optional

  Filter on event.

Example call

curl "https://passavo.eu/api/v1/webhook-deliveries" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/webhook-deliveries');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-deliveries', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/webhook-deliveries", headers=headers)
data = response.json()["data"]

Responses

• 200 — The delivery log of the last thirty days.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "event_id": "string",
            "event": "order.created",
            "endpoint_id": 1,
            "status": "pending",
            "sandbox": true,
            "attempts": 1,
            "last_status_code": 1,
            "body_excerpt": "string",
            "error": "string",
            "next_attempt_at": "2026-09-21T14:00:00+02:00",
            "delivered_at": "2026-09-21T14:00:00+02:00",
            "payload": {
                "id": "string",
                "type": "order.created",
                "created_at": "2026-09-21T14:00:00+02:00",
                "organisation_id": 1,
                "sandbox": true,
                "data": {}
            },
            "created_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

GET /api/v1/webhook-deliveries/{id} #

One delivery.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the delivery.

Example call

curl "https://passavo.eu/api/v1/webhook-deliveries/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/webhook-deliveries/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-deliveries/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/webhook-deliveries/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — One delivery.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "event_id": "string",
        "event": "order.created",
        "endpoint_id": 1,
        "status": "pending",
        "sandbox": true,
        "attempts": 1,
        "last_status_code": 1,
        "body_excerpt": "string",
        "error": "string",
        "next_attempt_at": "2026-09-21T14:00:00+02:00",
        "delivered_at": "2026-09-21T14:00:00+02:00",
        "payload": {
            "id": "string",
            "type": "order.created",
            "created_at": "2026-09-21T14:00:00+02:00",
            "organisation_id": 1,
            "sandbox": true,
            "data": {}
        },
        "created_at": "2026-09-21T14:00:00+02:00"
    }
}

POST /api/v1/webhook-deliveries/{id}/retry #

Offer a failed delivery again.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the delivery.

Example call

curl -X POST "https://passavo.eu/api/v1/webhook-deliveries/12/retry" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/webhook-deliveries/12/retry');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-deliveries/12/retry', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/webhook-deliveries/12/retry", headers=headers)
data = response.json()["data"]

Responses

• 202 — Offer a failed delivery again.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "event_id": "string",
        "event": "order.created",
        "endpoint_id": 1,
        "status": "pending",
        "sandbox": true,
        "attempts": 1,
        "last_status_code": 1,
        "body_excerpt": "string",
        "error": "string",
        "next_attempt_at": "2026-09-21T14:00:00+02:00",
        "delivered_at": "2026-09-21T14:00:00+02:00",
        "payload": {
            "id": "string",
            "type": "order.created",
            "created_at": "2026-09-21T14:00:00+02:00",
            "organisation_id": 1,
            "sandbox": true,
            "data": {}
        },
        "created_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/webhook-endpoints #

The destinations where you are notified.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• page[size] integer · in the url · optional

  Number per page, at most 100.

• page[cursor] string · in the url · optional

  The next_cursor from the previous page.

• sort string · in the url · optional

  Sort; a leading hyphen reverses the order.

  Values: created_at, -created_at, id, -id

• filter[status] string · in the url · optional

  Filter on status.

• filter[sandbox] string · in the url · optional

  Filter on sandbox.

Example call

curl "https://passavo.eu/api/v1/webhook-endpoints" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/webhook-endpoints');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/webhook-endpoints", headers=headers)
data = response.json()["data"]

Responses

• 200 — The destinations where you are notified.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": [
        {
            "id": 1,
            "url": "https://passavo.eu",
            "description": "string",
            "events": [
                "order.created"
            ],
            "status": "active",
            "sandbox": true,
            "consecutive_failures": 1,
            "last_delivery_at": "2026-09-21T14:00:00+02:00",
            "last_status_code": 1,
            "disabled_at": "2026-09-21T14:00:00+02:00",
            "disabled_reason": "string",
            "created_at": "2026-09-21T14:00:00+02:00",
            "updated_at": "2026-09-21T14:00:00+02:00"
        }
    ],
    "meta": {
        "next_cursor": "string"
    }
}

POST /api/v1/webhook-endpoints #

Create a destination; the secret is returned only once.

Right needed: webhooks

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

Example call

curl -X POST "https://passavo.eu/api/v1/webhook-endpoints" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->post('https://passavo.eu/api/v1/webhook-endpoints', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.post("https://passavo.eu/api/v1/webhook-endpoints", headers=headers, json={})
data = response.json()["data"]

Responses

• 201 — Create a destination; the secret is returned only once.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "url": "https://passavo.eu",
        "description": "string",
        "events": [
            "order.created"
        ],
        "status": "active",
        "sandbox": true,
        "consecutive_failures": 1,
        "last_delivery_at": "2026-09-21T14:00:00+02:00",
        "last_status_code": 1,
        "disabled_at": "2026-09-21T14:00:00+02:00",
        "disabled_reason": "string",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/webhook-endpoints/{id} #

One destination.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

Example call

curl "https://passavo.eu/api/v1/webhook-endpoints/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/webhook-endpoints/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/webhook-endpoints/12", headers=headers)
data = response.json()["data"]

Responses

• 200 — One destination.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "url": "https://passavo.eu",
        "description": "string",
        "events": [
            "order.created"
        ],
        "status": "active",
        "sandbox": true,
        "consecutive_failures": 1,
        "last_delivery_at": "2026-09-21T14:00:00+02:00",
        "last_status_code": 1,
        "disabled_at": "2026-09-21T14:00:00+02:00",
        "disabled_reason": "string",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

PATCH /api/v1/webhook-endpoints/{id} #

Update a destination.

Right needed: webhooks

This call sends a request body.

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

Example call

curl -X PATCH "https://passavo.eu/api/v1/webhook-endpoints/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{}'

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Str;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->withHeader('Idempotency-Key', (string) Str::uuid())
    ->patch('https://passavo.eu/api/v1/webhook-endpoints/12', []);

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12', {
  method: 'PATCH',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({}),
});

const { data } = await response.json();

import uuid

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY", "Idempotency-Key": str(uuid.uuid4())}
response = requests.patch("https://passavo.eu/api/v1/webhook-endpoints/12", headers=headers, json={})
data = response.json()["data"]

Responses

• 200 — Update a destination.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "url": "https://passavo.eu",
        "description": "string",
        "events": [
            "order.created"
        ],
        "status": "active",
        "sandbox": true,
        "consecutive_failures": 1,
        "last_delivery_at": "2026-09-21T14:00:00+02:00",
        "last_status_code": 1,
        "disabled_at": "2026-09-21T14:00:00+02:00",
        "disabled_reason": "string",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

DELETE /api/v1/webhook-endpoints/{id} #

Delete a destination, together with its delivery log.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

Example call

curl -X DELETE "https://passavo.eu/api/v1/webhook-endpoints/12" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->delete('https://passavo.eu/api/v1/webhook-endpoints/12');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12', {
  method: 'DELETE',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.delete("https://passavo.eu/api/v1/webhook-endpoints/12", headers=headers)
data = response.json()["data"]

Responses

• 204 — Delete a destination, together with its delivery log.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

POST /api/v1/webhook-endpoints/{id}/rotate-secret #

Issue a new secret; the old one stops working immediately.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

Example call

curl -X POST "https://passavo.eu/api/v1/webhook-endpoints/12/rotate-secret" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/webhook-endpoints/12/rotate-secret');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12/rotate-secret', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/webhook-endpoints/12/rotate-secret", headers=headers)
data = response.json()["data"]

Responses

• 200 — Issue a new secret; the old one stops working immediately.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "id": 1,
        "url": "https://passavo.eu",
        "description": "string",
        "events": [
            "order.created"
        ],
        "status": "active",
        "sandbox": true,
        "consecutive_failures": 1,
        "last_delivery_at": "2026-09-21T14:00:00+02:00",
        "last_status_code": 1,
        "disabled_at": "2026-09-21T14:00:00+02:00",
        "disabled_reason": "string",
        "created_at": "2026-09-21T14:00:00+02:00",
        "updated_at": "2026-09-21T14:00:00+02:00"
    }
}

GET /api/v1/webhook-endpoints/{id}/sample #

A signed example to test your own verification against.

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

• event string · in the url · optional

  Which event the example imitates; test.ping by default.

  Values: order.created, order.paid, order.cancelled, order.refunded, ticket.issued, ticket.scanned, ticket.voided, slot.sold_out, slot.reopened, voucher.issued, voucher.redeemed, pass.issued, pos.session_closed, invoice.issued, test.ping

Example call

curl "https://passavo.eu/api/v1/webhook-endpoints/12/sample" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->get('https://passavo.eu/api/v1/webhook-endpoints/12/sample');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12/sample', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.get("https://passavo.eu/api/v1/webhook-endpoints/12/sample", headers=headers)
data = response.json()["data"]

Responses

• 200 — A signed example to test your own verification against.
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "endpoint_id": 1,
        "event": "string",
        "headers": {},
        "body": "string",
        "payload": {
            "id": "string",
            "type": "order.created",
            "created_at": "2026-09-21T14:00:00+02:00",
            "organisation_id": 1,
            "sandbox": true,
            "data": {}
        },
        "signature": {
            "header": "string",
            "timestamp": 1,
            "scheme": "string",
            "signed_payload": "string",
            "tolerance_seconds": 1
        }
    }
}

POST /api/v1/webhook-endpoints/{id}/test #

Send a test message (test.ping).

Right needed: webhooks

Parameters

• Accept-Language string · as a header · optional

  The language of the translated fields, falling back to the organisation's language.

• id integer · in the path · required

  The id of the destination.

Example call

curl -X POST "https://passavo.eu/api/v1/webhook-endpoints/12/test" \
  -H "Authorization: Bearer pv_live_YOUR_API_KEY" \
  -H "Accept: application/json"

use Illuminate\Support\Facades\Http;

$response = Http::acceptJson()
    ->withToken('pv_live_YOUR_API_KEY')
    ->post('https://passavo.eu/api/v1/webhook-endpoints/12/test');

$data = $response->json('data');

const response = await fetch('https://passavo.eu/api/v1/webhook-endpoints/12/test', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    Authorization: 'Bearer pv_live_YOUR_API_KEY',
  },
});

const { data } = await response.json();

import requests

headers = {"Accept": "application/json", "Authorization": "Bearer pv_live_YOUR_API_KEY"}
response = requests.post("https://passavo.eu/api/v1/webhook-endpoints/12/test", headers=headers)
data = response.json()["data"]

Responses

• 202 — Send a test message (test.ping).
• 401 — This key is not valid.
• 403 — This key is not allowed to do that.
• 404 — Not found.
• 409 — This Idempotency-Key was already used for a different request.
• 422 — The request is not valid.
• 429 — Too many calls. Try again in 60 seconds.

Example response

{
    "data": {
        "endpoint_id": 1,
        "event": "string",
        "delivery_id": 1,
        "event_id": "string"
    }
}