Customer API

The Customer API lets you build customer-facing applications where customers can manage their profile and payment methods, view orders, bookings, memberships, companies, wallet cards, guest flows, and enquiries, and use eligible access features. It is designed for browsers, mobile apps, and other customer-facing clients.

Base URL

https://edge.tiquo.app/api/client/v1

Authentication

Customer-scoped operations require a valid JWT access token in the Authorization header. Tokens are issued to customers through one of two authentication methods:

• DOM Package - Email OTP flow for browser-based apps
• OAuth/OIDC - Authorization code flow for more complex integrations

Authorization: Bearer eyJhbGciOiJSUzI1NiJ9...

Access tokens expire after at most 1 hour and can be shorter when the original customer session is close to expiry. Use the refresh endpoint to get a new token pair before the current token expires.

There are two explicit exceptions:

• POST /refresh authenticates with a refresh token in the request body.
• POST /enquiries can accept an unauthenticated website submission with a public integration key and an allowed origin.

See Customer Authentication with the DOM Package and Customer Authentication with OAuth/OIDC for more details on how tokens are obtained and managed.

Package Coverage

The Customer API can be called directly, and parts of it are wrapped by the two browser integrations:

• The npm DOM Package wraps profile and photo updates, orders, bookings and ticket downloads, receipts, enquiries, and companies. It handles Customer API token refresh automatically.
• The Hosted Package wraps profile and photo updates, orders, bookings, memberships, guest flows, and wallet-card links through window.Tiquo and related data-tiquo-* attributes. It also handles Customer API token refresh automatically.
• Payment methods and access-control operations currently require direct Customer API calls. The deprecated legacy wallet-ticket exchange is intended only for older clients.

Not every feature bundled into those packages is part of the Customer API. OTP delivery and verification, logout, iframe authentication, service catalogs, and website analytics use separate Auth DOM or analytics endpoints and are intentionally outside this reference.

CORS

Authenticated Customer API requests support browser CORS and reflect the requesting origin. Public enquiry submissions are additionally restricted by the integration key's allowed-domain configuration.

Available Endpoints

Data Scope

Customer API responses are scoped to the authenticated customer's organization and identity. Most endpoints return only the customer's own data. The exception is GET /companies/colleagues: a customer who is an administrator of an associated company can view basic contact cards for colleagues in that company. Customers without that company-admin role receive 403 Forbidden.

Response Format

Most successful read operations use this envelope:

{
  "success": true,
  "data": { ... }
}

Some operations keep resources at the top level for SDK compatibility. In particular, profile updates return customer, enquiry creation returns enquiry and customer, and payment-method operations return paymentMethods, setupIntentId, clientSecret, or paymentMethod. Follow the response schema documented for each operation.

JSON error responses use:

{
  "success": false,
  "error": "Invalid or expired token"
}

Common Errors