Prove who is at the desk: unlock, step up, or switch
const url = 'https://api.aerandil.com/v1/desk/sessions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/passcode';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"employee_id":"example","passcode":"example","staff_member_id":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","unlock_token":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aerandil.com/v1/desk/sessions/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/passcode \ --header 'Content-Type: application/json' \ --data '{ "employee_id": "example", "passcode": "example", "staff_member_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "unlock_token": "example" }'Public — a locked desk holds no bearer, only the shift’s unlock token. With it, an employee and their passcode (the floor handset’s passcode, under the same per-staff lockout): the person already at the desk unlocks or steps up (desk_session.stepped_up); another member of the property’s desk staff takes the desk (desk_session.switched, under their own principal). Either way the answer is a fresh bearer for that person carrying a step-up window (AERANDIL_DESK_STEP_UP_TTL), inside which the step-up-gated verbs and markings are theirs. Every refusal about the person reads the same (invalid_desk_credentials); a session that has ended says so (desk_session_ended). Rate-limited per IP like /oauth/token.
Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”The desk_session id.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Who is at the desk, as typed at the lock screen (the staff_member business key). Exactly one of employee_id and staff_member_id.
The staff member’s passcode — the same one the floor handset takes.
Who is at the desk, when the desk already knows (a step-up).
The shift’s unlock token, from opening the session. It grants nothing alone and is never a bearer.
Examplegenerated
{ "employee_id": "example", "passcode": "example", "staff_member_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "unlock_token": "example"}Responses
Section titled “Responses”Proven; the bearer runs as the person at the desk.
object
Short-lived HS256 JWT. Send as Authorization: Bearer <token> on subsequent calls.
Token lifetime in seconds. Default 3600 (one hour); deployment-configurable via AERANDIL_TOKEN_TTL_SECS.
Space-separated list of granted scopes. The set the token actually carries — already narrowed by any scope request filter and the client’s pre-provisioned grants.
Always Bearer in v1.
Idle seconds after which the desk locks (AERANDIL_DESK_IDLE_LOCK).
The outlet whose till the session is; absent at the front desk.
The houses the person the bearer runs as may hold the desk at — one per front-office staff record claiming their identity — the choices POST /v1/desk/sessions/{id}/move takes.
The desk role the scope vector came from (the F&B roles at a till).
When the shift — and every token minted for it — ends.
The staff member the bearer runs as — its User principal.
Seconds a step-up is honoured for (AERANDIL_DESK_STEP_UP_TTL).
Until when this bearer carries a step-up proof. Absent on the sign-in’s own bearer: an identity-provider session may be silently re-used, so it is not a proof.
On a passcode proof: whether the desk changed hands.
Only when opening: what a locked desk keeps to come back by passcode.
Example
{ "token_type": "Bearer", "role": "front_desk"}Headers
Section titled “Headers”Always no-store. Object and link state is live data and is never cacheable.
invalid_desk_credentials (no detail by design) or desk_session_ended.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}Neither or both of employee_id and staff_member_id, or no passcode.
Structured error wrapper. Every non-2xx response from any Aerandil endpoint serialises to this shape; the HTTP status carries the failure class (4xx/5xx), the body adds a stable code for programmatic dispatch plus a human-readable message.
object
object
Stable, programmatic error code (e.g. unauthorized, forbidden, not_found, invalid_body, invalid_url, precondition_failed, no_secondary_key). Clients dispatch on code, not on the message (which may be localised or contextualised in future versions).
Request-id correlation handle echoed on the request-id response header — support teams correlate without scraping logs.
Human-readable explanation of the failure.
Per-error structured detail. The shape varies by code (e.g. forbidden_action carries {"action": "..."}; precondition_failed carries {"current_version": N}).
Examplegenerated
{ "error": { "code": "example", "instance_id": "example", "message": "example", "parameters": "example" }}Per-IP rate limit exceeded (the /oauth/token limiter).