---
title: "Look at a pass without spending it."
method: GET
path: "/passes/{token}"
tags: ["Passes"]
---

# Look at a pass without spending it.

`GET /passes/{token}`

## Request

- Base URL: `https://getdynamicqr.com/api/v1`
- URL: `https://getdynamicqr.com/api/v1/passes/{token}`
- Auth: API key in header `X-Client-ID` and HTTP bearer

The read-only twin of the validate endpoint, for showing a holder the state of their
own ticket. Looking at a pass must never spend it, so nothing is redeemed and nothing
is recorded.

A pass belonging to another account is reported as not found rather than forbidden:
confirming that somebody else's ticket exists is itself a leak.

**Requires the `pass_validation` plan feature.** Without it this endpoint answers 403 even with valid credentials.

## Path parameters

- `token` string, required

## Response `200`

OK

## Other responses

- `401`: No credentials, or credentials that are not valid.
- `403`: The account is inactive, or the plan does not carry this feature.
- `404`: Not found
- `429`: Rate limit exceeded. See `Retry-After`.

---

[API](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api.md) · [All operations](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/revisions/4467aeca30ce?raw)