---
title: "Is this referral code live? Unauthenticated, on purpose."
method: GET
path: "/api/v1/affiliate/code/{code}/valid"
tags: ["Affiliate"]
---

# Is this referral code live? Unauthenticated, on purpose.

`GET /api/v1/affiliate/code/{code}/valid`

## Request

- Base URL: `https://api.avatarfactory.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.avatarfactory.io/api/v1/affiliate/code/{code}/valid`
- Auth: one of:
  - API key in cookie `session`
  - HTTP bearer

<br/>The marketing site calls this cross-origin to show "20 percent off<br/>unlocked" once the `af_ref` cookie is set. It carries the verdict and the<br/>code the caller already sent, and nothing about the affiliate behind it:<br/>no name, no status, no id. Allowlisted by endpoint name in<br/>`app/__init__.py`, the same way the Resend webhook is.

## Path parameters

- `code` string, required

## Response `200`

OK

- CodeValidResponse: The public code check. The verdict and the code the caller sent, nothing else.
  - `code` string, required
  - `valid` boolean, required

## Other responses

- `422`: Unprocessable Entity

---

[API](https://skmtc.dev/avatarfactory/apis/avatarfactory-api.md) · [All operations](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/avatarfactory/apis/avatarfactory-api/revisions/66fc7aa3f296?raw)