---
title: "Check a pass and, when it is good, spend one admission."
method: POST
path: "/passes/validate"
tags: ["Passes"]
---

# Check a pass and, when it is good, spend one admission.

`POST /passes/validate`

## Request

- Base URL: `https://getdynamicqr.com/api/v1`
- URL: `https://getdynamicqr.com/api/v1/passes/validate`
- Auth: API key in header `X-Client-ID` and HTTP bearer

Spends one admission when the pass is good. The check and the increment happen inside
a transaction against a locked row, so two doors scanning the same ticket in the same
second cannot both admit.

Every attempt is recorded, refusals included — "the door said it was already used" is
a dispute somebody has to settle later. Staff can only validate passes belonging to
their own account, and another account's pass reads as not found.

**Requires the `pass_validation` plan feature.** Without it this endpoint answers 403 even with valid credentials.

## Request body

- object
  - `token` string, required: The scanned value — a token or the URL a camera read.
  - `gate` string: Which door this was, for the audit trail.

## Response `200`

OK

## Other responses

- `401`: No credentials, or credentials that are not valid.
- `403`: Forbidden
- `429`: Rate limit exceeded. See `Retry-After`.

---

[API](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api.md) · [All operations](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/revisions/4467aeca30ce?raw)