Customer API

The Customer API lets you build customer-facing applications where customers can manage their profile and payment methods, view orders, bookings, memberships, companies, wallet cards, guest flows, and enquiries, and use eligible access features. It is designed for browsers, mobile apps, and other customer-facing clients.

Base URL

https://edge.tiquo.app/api/client/v1

Authentication

Customer-scoped operations require a valid JWT access token in the Authorization header. Tokens are issued to customers through one of two authentication methods:

• DOM Package - Email OTP flow for browser-based apps
• OAuth/OIDC - Authorization code flow for more complex integrations

Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...

Access tokens expire after at most 1 hour and can be shorter when the original customer session is close to expiry. Use the refresh endpoint to get a new token pair before the current token expires.

These operations use different authentication:

• POST /refresh authenticates with a refresh token in the request body.
• POST /enquiries can accept an unauthenticated website submission with a public integration key and an allowed origin.
• POST /marketing/subscribe uses a public integration key and allowed Origin for opt-in signup without login.

See Customer Authentication with the DOM Package and Customer Authentication with OAuth/OIDC for more details on how tokens are obtained and managed.

Package coverage

The Customer API can be called directly, and parts of it are wrapped by the two browser integrations:

• The npm DOM Package wraps profile and photo updates, orders, bookings (including cancelling, rescheduling, and ticket downloads), receipts, enquiries, companies, guest flows, guest invitations and passes, and wallet-card links. It handles Customer API token refresh automatically.
• The Hosted Package wraps profile and photo updates, orders, bookings (including cancelling and rescheduling), memberships, guest flows, guest invitations and passes, and wallet-card links through window.Tiquo and related data-tiquo-* attributes. It also handles Customer API token refresh automatically.
• Payment methods and access-control operations currently require direct Customer API calls. The deprecated legacy wallet-ticket exchange is intended only for older clients.

Some package features use separate Auth DOM or analytics endpoints and are covered outside this Customer API reference: OTP delivery and verification, logout, iframe authentication, service catalogs, and website analytics.

CORS

Authenticated Customer API requests support browser CORS and reflect the requesting origin. Public enquiry and marketing signup submissions are additionally restricted by the integration key's allowed-domain configuration.

Available endpoints

Data scope

Customer API responses are scoped to the authenticated customer's organization and identity. Most endpoints return only the customer's own data. The exception is GET /companies/colleagues: a customer who is an administrator of an associated company can view basic contact cards for colleagues in that company. Customers without that company-admin role receive 403 Forbidden.

Response format

Most successful read operations use this envelope:

{
  "success": true,
  "data": { ... }
}

Some operations keep resources at the top level for SDK compatibility. In particular, profile updates return customer, enquiry creation returns enquiry and customer, and payment-method operations return paymentMethods, setupIntentId, clientSecret, or paymentMethod. Membership-payment operations return recovery, setup, link, or billingAddress at the top level. Follow the response schema documented for each operation.

JSON error responses use:

{
  "success": false,
  "error": "Invalid or expired token"
}

Common errors

Guest invitation endpoints

Guest Invitations and Passes covers GET /guest-passes, GET /guest-invitations, POST /guest-invitations, and POST /guest-invitations/accept. These use a customer token; invitation operations require a completed profile.

Public Marketing Signup covers opt-in-only website submissions with an integration key and allowed Origin.