Attach an identity to a person, with evidence (session only)

POST

/persons/{person_id}/identities

curl --request POST \
  --url https://quikstik-core.fly.dev/persons/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/identities \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'x-tenant-id: 2489E9AD-2EE2-8E00-8EC9-32D5F69181C0' \
  --data '{ "kind": "email", "value": "example", "evidence": "example" }'

• Production

A human decision: session bearer only — an operator key is refused. value is normalised (email and relay aliases lower-cased, phone digits only, ota_ref upper-cased). An identity belongs to ONE person per tenant: attaching a value another person owns is 409 identity_owned_by_another_person (resolve it with a merge). Re-attaching the same value to the same person is 200 and writes nothing. 422 for an unknown kind, an impossible value, or missing/over-long (240 chars) evidence.

Authorizations

• bearerAuth

Parameters

Path Parameters

person_id

required

string format: uuid

Header Parameters

x-tenant-id

required

string format: uuid

Tenant identifier (UUID).

Authn/authz semantics are intentionally TBD for this contract slice; this header exists to keep the contract explicitly multi-tenant from day 0.

Request Body^required

Media typeapplication/json

object

kind

required

string

Allowed values: email phone viator_relay gyg_relay ota_ref

value

required

string

evidence

required

One line — what proved it.

string

<= 240 characters

Responses

200

Already attached to this person.

201

Attached.

401

Missing or invalid session bearer token

Media typeapplication/json

object

reason

required

Stable, machine-readable reason code (e.g. “sold_out”, “processor_not_configured”, “rail_refused”).

string

Example

{
  "reason": "sold_out"
}

403

The session’s effect authority does not cover this operation

Media typeapplication/json

object

reason

required

Stable, machine-readable reason code (e.g. “sold_out”, “processor_not_configured”, “rail_refused”).

string

Example

{
  "reason": "sold_out"
}

404

Expired, consumed, unknown, or unresolvable — indistinguishable by design

Media typeapplication/json

object

reason

required

string

Example ^generated

{
  "reason": "example"
}

409

Another person in this tenant owns the identity (identity_owned_by_another_person, with owner_person_id).

422

Invalid kind, value or evidence.

503

No durable backend is wired for this operation (fail-closed)

Media typeapplication/json

object

reason

required

Stable, machine-readable reason code (e.g. “sold_out”, “processor_not_configured”, “rail_refused”).

string

Example

{
  "reason": "sold_out"
}