---
title: "Exchange an invitation code for a session"
method: POST
path: "/guest-access/verify"
tags: ["Guest access"]
---

# Exchange an invitation code for a session

`POST /guest-access/verify`

## Request

- Base URL: `https://api.aisle.wedding/v1`
- URL: `https://api.aisle.wedding/v1/guest-access/verify`
- Auth: HTTP bearer

Call from your server with its wedding API key. Requires read scope and preview access. Codes ignore case, ASCII spaces and hyphens. Incorrect, foreign, expired, revoked or empty-membership codes return the same 401 error. Existing durable quotas apply before verification: 120 requests per API key and 600 per wedding per minute, including incorrect codes. The session expires after at most 2592000 seconds or at credential expiry. Keep it in an HttpOnly cookie on your own origin and verify it before every protected request.

## Request body

- GuestAccessVerify
  - `code` string, required

## Response `200`

Exchange an invitation code for a session

- object
  - `data` GuestAccessSessionIssued, required
    - `access` GuestAccess, required
      - `id` string, required
      - `name` string, nullable, required
      - `guest_ids` GuestId[], required
      - `expires_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `revoked_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `created_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
      - `updated_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.
    - `session_token` string, required: Guest access session for server-side verification. It cannot replace the wedding API key or a native Aisle guest cookie.
    - `expires_at` string, date-time, required: An RFC 3339 UTC timestamp with milliseconds.

## Other responses

- `400`: The request itself could not be read, such as a body that is not a JSON object. A field we refuse is validation_failed instead.
- `401`: The API key is missing, malformed, or no longer valid.
- `402`: The operation requires an active Aisle membership for this wedding.
- `403`: The key is valid but not permitted to do this.
- `404`: No such resource inside the key's wedding.
- `409`: The request collided with the current state of the resource.
- `415`: A request body must be sent as application/json.
- `422`: The request was well-formed but a field was not acceptable. Every field at fault is named in error.details.
- `429`: Too many requests. Retry after the time given in Retry-After.
- `500`: Something went wrong on our side.

---

[API](https://skmtc.dev/aisle/apis/aisle-api.md) · [All operations](https://skmtc.dev/aisle/apis/aisle-api/llms.txt) · [OpenAPI document](https://skmtc.dev/aisle/apis/aisle-api/revisions/689a2f2420cc?raw)