Skip to content
Session Services Session Services Logo

Public vs Authenticated Access

Understand which routes are public, which require bearer auth, and where signatures are required.

All requests require x-tenant-id. Bearer tokens are only required for authenticated operations.

Access Matrix

ResourcePublic routesAuthenticated routes
eventget, listcreate, update, remove, feature, like, performance
admissionget, listcreate, update, remove, quote
sectionget, listcreate, update, remove
venueget, listcreate, update, remove, linkLocation, unlinkLocation
tenantconfig, regions—
teamgetlist, create, update, remove, performance
promotergetlist, create, update, remove, performance
orderget, quote, create, update, reservelist, resend, refund, notes
ticketlistget, create, update, scan
analyticstrack, page, identify, alias, group, screensame routes available with auth context
coupon—get, list, create, update, remove, code.*
location—get, list
payout / beneficiary / internal—authenticated only

Signature-Gated Public Routes

Some public routes are intentionally available for checkout/confirmation flows, but still require signatures:

  • order.update requires signature
  • order.reserve requires signature
  • ticket.list with orderId requires either bearer permission or orderSignature

Practical Rule

Use public routes for storefront rendering and checkout initiation. Use bearer-auth routes for management, operations, and back-office workflows.