API overview

The Passlet public API is a REST API for automating everything around passes: issuing and updating them, recording scans, managing projects and webhook endpoints, and reading template metadata.

Base URL: https://api.passlet.io

The full endpoint reference in the sidebar is generated from our OpenAPI 3.1 specification (downloadable at /api-reference/openapi.json), which is itself generated from the live route definitions, so it cannot drift from the API’s actual behavior.

Authentication

Every request needs an access token (plt_...), sent either way:

# Authorization header (preferred)
curl https://api.passlet.io/v1/passes \
  -H "Authorization: Bearer $PASSLET_API_TOKEN"

# or X-API-Key header
curl https://api.passlet.io/v1/passes \
  -H "X-API-Key: $PASSLET_API_TOKEN"

Tokens belong to exactly one workspace. The API resolves your workspace from the token, so there is no workspace parameter anywhere. Requests without a valid token get 401 UNAUTHORIZED; requests whose token lacks the operation’s scope get 403 FORBIDDEN.

Scopes

Most operations require a scope, documented on their endpoint pages (and machine-readable as x-required-scopes in the spec): passes:read, passes:write, pass-notifications:read, pass-notifications:write, templates:read, webhooks:read, webhooks:write, scans:read. The connection-verification operation accepts any valid access token so integrations can test a least-privilege credential without borrowing an unrelated resource scope.

Resources

Resource	What it covers
Connection	Verify a token and identify its Passlet workspace
Passes	Issue (single or batch), read, void (single or batch), revoke add-to-wallet links
Pass notifications	Send, schedule, track, and cancel messages pushed to issued wallet passes
Templates	List templates, fetch the published version and its variables schema
Template versions	List and read immutable published versions
Projects	Create, read, update, and delete projects, plus per-project statistics
Scans	Record (single or bulk), list, read, aggregate counts, real-time stream
Webhooks	Manage endpoints, send test events, inspect delivery history, redeliver

Conventions

JSON everywhere: request and response bodies are application/json (UTF-8).
IDs are opaque strings; don’t parse them.
Timestamps are ISO 8601 / RFC 3339 in UTC.
Idempotent issuance: externalPassId is unique per workspace, so re-sending a create with the same external ID doesn’t create a duplicate pass.
Async lifecycle: issuing, updating, and voiding are queued and processed in the background. The API returns immediately with the pass in its transitional status. Subscribe to webhooks rather than polling.
Errors use a stable machine-readable shape with errorCode, message, and correlationId. See Errors.
Pagination and filtering are cursor-based, with one consistent filter grammar across list endpoints. See Pagination and filtering.

Using the API

Endpoints

Authentication

Scopes

Resources

Conventions

​Authentication

​Scopes

​Resources

​Conventions

Authentication

Scopes

Resources

Conventions