Skip to main content
POST
cURL

Headers

X-CSRF-Token
string
required

Echoes the token from the current session. Required on every unsafe method.

Body

application/json
reference
string
required

What the operator calls the batch. Unique, and what they search for.

planVersionId
string<uuid>
required

A version rather than a plan: publishing a new version must not change what people already hold a code for.

quantity
integer
required
Required range: 1 <= x <= 10000
unitPriceMinor
integer<int64>
required

The agreed wholesale price, recorded and never charged. The money changed hands outside Omniflow.

currency
string
required
id
string<uuid>
planCode
string
planVersion
integer
billingPeriod
string
note
string
issued
integer<int64>

Codes nobody has redeemed, and therefore what revoking would kill.

redeemed
integer<int64>
revoked
integer<int64>
expiresAt
string<date-time>

Absent means the codes never expire.

revokedAt
string<date-time>
revokeReason
string
createdAt
string<date-time>
createdBy
string<uuid>

Response

Generated

batch
object
required
codes
string[]
required

Returned once and never again. Only the SHA-256 of each is stored, so no other endpoint can produce them.