Information
- OpenAPI version:
3.0.3
Overview
Quikstik API 2026-11-01
Section titled “Quikstik API 2026-11-01”The HTTP API behind Quikstik: catalog, availability, checkout, bookings, money, customers, content and conditions, for one or many tenants.
This document is generated from the contracts the server is tested against and lists only routes that are live in production. Operator-app surfaces that are still changing are not included yet.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”First-party session bearer token. The verified session supplies the tenant and actor; effect authority is resolved at ingress. Operator-scoped operations require a session whose authority covers them.
Security scheme type: http
operatorApiKey
Section titled “operatorApiKey”Operator API key (sk_op_…), presented with X-Tenant-Id. Effective authority is the key’s
scopes ∩ the acting member’s live membership; policies.write (policy writes) is
underwritten only by an Admin/Owner. Never a publishable key.
Security scheme type: apiKey
Header parameter name: x-api-key
publishableKey
Section titled “publishableKey”Anonymous storefront publishable key (the 048 §2.3 tier extended to the transactional storefront). Paired with X-Tenant-Id and verified against that tenant; grants the capability-limited storefront set — browse offerings, read availability, create a booking-intent hold — and nothing else. Operator-scoped operations do not accept it.
Security scheme type: apiKey
Header parameter name: x-api-key
bearerSession
Section titled “bearerSession”First-party session token.
Security scheme type: http
operatorKey
Section titled “operatorKey”Operator API key (sk_op_…), presented with x-tenant-id. Accepted on operator read
routes only; effective authority is the key’s scopes ∩ the actor’s live membership.
Security scheme type: apiKey
Header parameter name: x-api-key