The response is illustrative, not the result of a live request.
Request parameters
JSON body
customerIduuidRequired
Indiana customer ID mapped from a verified identity on the server. Omit for customer-token calls, which use the token-bound customer.
Response fields
Successful responses include requestId and scope. Use the actual business status or accepted field to determine the result. Optional fields are omitted when unavailable.
HTTP 200 · application/json
requestIduuidRequired
Server-generated HTTP request UUID. Include it when reporting a failed request.
scopeobjectRequired
The App and environment of this response. Headers only verify scope; they cannot switch key scope.
Show child fields
projectIdstringRequired
App ID bound to the credential.
minLength: 1
environmentenumRequired
Separate data scope: sandbox or live.
Show allowed values
"sandbox""live"
customerTokenstringRequired
Short-lived customer token. Return only to its verified user; exclude from logs and persistent browser storage.
minLength: 1
expiresAtdate-timeRequired
ISO 8601 UTC expiry. Expired sessions and reservations cannot be reused.
sessionIduuidRequired
The sessionId value for this operation. Its accepted type and constraints are listed above and below.
Handle errors
Common failures
Code
Recovery
UNAUTHENTICATED
Verify the key or refresh the expired customer token once.
FORBIDDEN
Check current key permissions and customer access.
INVALID_REQUEST
Check field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCH
Use the App and environment bound to the credential.
Common failures
UNAUTHENTICATED
Recovery
Verify the key or refresh the expired customer token once.
FORBIDDEN
Recovery
Check current key permissions and customer access.
INVALID_REQUEST
Recovery
Check field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCH
Recovery
Use the App and environment bound to the credential.