Changelog

What changed in the Passtastic API, newest first — so an integration can tell what to re-test after an update.

2026-10-27

New scope bookings:read with GET /v1/bookings (list by day, cursor paging) and GET /v1/bookings/{id}. It is not given to new keys by default: the merchant ticks it when creating a key. New webhook events booking.created, booking.updated, booking.seated, booking.finished, booking.cancelled and booking.no_show. Nothing changes for existing keys.

2026-10-19

POST /v1/customers and PATCH /v1/customers/{ref} accept allowClaimByExternalId, and customer reads return it. For a POS that creates customers with only an ID number: until the card is first added to a wallet, typing that externalCustomerId in the card's sign-up form hands the card over, with no email or phone check. New error EXTERNAL_ID_REQUIRED. Nothing changes unless you send it.

2026-10-13

People. Customer results (enroll, lookup, read, update, renew, test-mode expire, earn, redeem, adjust) and every webhook's data now carry personId: the same id for all of one person's cards. It is best-effort and may be absent, so do not require it. New GET /v1/people/{personId} and GET /v1/people/lookup (scope customers:read). A per_… id is accepted as a customer {ref}. New errors AMBIGUOUS_PERSON_MATCH, PERSON_NOT_FOUND, EMAIL_OR_PHONE_REQUIRED, EMAIL_MUST_BE_A_SINGLE_VALUE and PHONE_MUST_BE_A_SINGLE_VALUE. Nothing was removed or renamed, so existing integrations keep working.

2026-10-13

Behaviour change: /earn and /redeem on an expired card now return 409 CARD_EXPIRED and write nothing, the same way the Scanner app refuses it. /adjust still works on an expired card.

Test mode: POST /v1/customers/{ref}/expire (scope customers:write, test keys only) ends a test customer's card now, so you can test customer.expired, an expired status and /renew without waiting for a real end date.

2026-10-11

Card validity. GET /v1/customers/{ref} and GET /v1/customers/lookup return status, expiresAt and expiredAt; status reads expired from the moment the end date passes. New webhooks customer.expired and customer.renewed. New POST /v1/customers/{ref}/renew (scope customers:write) renews a card like "Renew membership" in the dashboard, including for a customer who took the card out of their wallet: their renewal email lets them add it back.

2026-10-09

Customers now have firstName and lastName. POST /v1/customers and PATCH /v1/customers/{ref} accept them (a single name still works), and customer reads return name, firstName and lastName.

2026-09-28

Test keys and TEST passes · Webhook retries for 24 hours · Rate limits · OpenAPI description at /api/v1/openapi.json · Webhooks are delivered again (a network-guard bug had blocked every delivery) · Store-credit balances are returned in whole units; store-credit changes send balance.updated · POST /v1/customers accepts sendCardEmail to have Passtastic email the wallet-install link when enroll creates a new customer (never on a match) — response adds cardEmail / cardEmailReason.

2026-07-14

Developer API launched.