# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"
# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="POST"
PATH_AND_QUERY="$API_PATH/gateway/xp/earn"
# One compact line, signed and sent unchanged. The server signs a
# re-serialization of the body it parsed, so reformatting this fails with a 401.
BODY='{"user_id":"YOUR_USER_ID","amount":0}'
TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
| openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"
curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
-H "X-Tenant-Key: $KEY" \
-H "X-Tenant-Timestamp: $TIMESTAMP" \
-H "X-Tenant-Signature: $SIGNATURE" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: YOUR_IDEMPOTENCY_KEY" \
--data-binary "$BODY"const options = {
method: 'POST',
headers: {
'X-Tenant-Signature': '<x-tenant-signature>',
'X-Tenant-Timestamp': '<x-tenant-timestamp>',
'X-Idempotency-Key': '<x-idempotency-key>',
'x-tenant-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({amount: 123, user_id: '<string>', notes: '<string>'})
};
fetch('https://api.kintra.io/api/v1/gateway/xp/earn', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.kintra.io/api/v1/gateway/xp/earn"
payload = {
"amount": 123,
"user_id": "<string>",
"notes": "<string>"
}
headers = {
"X-Tenant-Signature": "<x-tenant-signature>",
"X-Tenant-Timestamp": "<x-tenant-timestamp>",
"X-Idempotency-Key": "<x-idempotency-key>",
"x-tenant-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"transaction": {
"amount": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"metadata": null,
"notes": "<string>",
"onchain_asset_id": "<string>",
"redemption_id": "<string>",
"tenant_id": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"blockchain_transaction_links": {
"blockchain_transaction": [
{
"id": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"metadata": null,
"receipt_block_hash": "<string>",
"receipt_block_number": "<string>",
"receipt_block_timestamp": 123,
"receipt_gas_price": "<string>",
"receipt_gas_used": "<string>",
"receipt_status": 123,
"receipt_transaction_index": 123,
"tx_data": "<string>",
"tx_from": "<string>",
"tx_gas_limit": "<string>",
"tx_gas_price": "<string>",
"tx_hash": "<string>",
"tx_max_fee_per_gas": "<string>",
"tx_max_priority_fee_per_gas": "<string>",
"tx_nonce": 123,
"tx_to": "<string>",
"tx_type": 123,
"tx_value": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
}
]
},
"onchain_asset": {
"asset_address": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"decimals": 123,
"deploy_tx_hash": "<string>",
"deployed_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"key": "<string>",
"metadata": null,
"name": "<string>",
"status": "<string>",
"symbol": "<string>",
"total_owners": 123,
"total_txns": 123,
"type": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
},
"reward": {
"id": "<string>",
"title": "<string>"
},
"tenant": {
"id": "<string>",
"name": "<string>",
"slug": "<string>"
},
"user": {
"email": "<string>",
"id": "<string>",
"username": "<string>"
}
}
},
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}Award XP to a customer
Credits amount XP to the customer named by user_id, with optional notes recorded against the entry. Call it when a customer completes something you reward, which for most integrations is the write this surface exists for. The response data carries the transaction the credit created, which you can read back through the internal transaction routes. X-Idempotency-Key is required: a missing key returns 400 IDEMPOTENCY_KEY_REQUIRED, and a replay of the same key returns the stored response rather than crediting the customer twice. Reusing a key with a different request returns 422 IDEMPOTENCY_KEY_CONFLICT, and replaying a key whose first request is still in flight returns 409 with the same code. A first request that never recorded a response keeps returning 409 until the key ages out, so send a fresh key rather than retrying that one.
# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"
# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="POST"
PATH_AND_QUERY="$API_PATH/gateway/xp/earn"
# One compact line, signed and sent unchanged. The server signs a
# re-serialization of the body it parsed, so reformatting this fails with a 401.
BODY='{"user_id":"YOUR_USER_ID","amount":0}'
TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
| openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"
curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
-H "X-Tenant-Key: $KEY" \
-H "X-Tenant-Timestamp: $TIMESTAMP" \
-H "X-Tenant-Signature: $SIGNATURE" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: YOUR_IDEMPOTENCY_KEY" \
--data-binary "$BODY"const options = {
method: 'POST',
headers: {
'X-Tenant-Signature': '<x-tenant-signature>',
'X-Tenant-Timestamp': '<x-tenant-timestamp>',
'X-Idempotency-Key': '<x-idempotency-key>',
'x-tenant-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({amount: 123, user_id: '<string>', notes: '<string>'})
};
fetch('https://api.kintra.io/api/v1/gateway/xp/earn', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.kintra.io/api/v1/gateway/xp/earn"
payload = {
"amount": 123,
"user_id": "<string>",
"notes": "<string>"
}
headers = {
"X-Tenant-Signature": "<x-tenant-signature>",
"X-Tenant-Timestamp": "<x-tenant-timestamp>",
"X-Idempotency-Key": "<x-idempotency-key>",
"x-tenant-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"transaction": {
"amount": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"metadata": null,
"notes": "<string>",
"onchain_asset_id": "<string>",
"redemption_id": "<string>",
"tenant_id": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"blockchain_transaction_links": {
"blockchain_transaction": [
{
"id": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"metadata": null,
"receipt_block_hash": "<string>",
"receipt_block_number": "<string>",
"receipt_block_timestamp": 123,
"receipt_gas_price": "<string>",
"receipt_gas_used": "<string>",
"receipt_status": 123,
"receipt_transaction_index": 123,
"tx_data": "<string>",
"tx_from": "<string>",
"tx_gas_limit": "<string>",
"tx_gas_price": "<string>",
"tx_hash": "<string>",
"tx_max_fee_per_gas": "<string>",
"tx_max_priority_fee_per_gas": "<string>",
"tx_nonce": 123,
"tx_to": "<string>",
"tx_type": 123,
"tx_value": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
}
]
},
"onchain_asset": {
"asset_address": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"decimals": 123,
"deploy_tx_hash": "<string>",
"deployed_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"key": "<string>",
"metadata": null,
"name": "<string>",
"status": "<string>",
"symbol": "<string>",
"total_owners": 123,
"total_txns": 123,
"type": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
},
"reward": {
"id": "<string>",
"title": "<string>"
},
"tenant": {
"id": "<string>",
"name": "<string>",
"slug": "<string>"
},
"user": {
"email": "<string>",
"id": "<string>",
"username": "<string>"
}
}
},
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}Authorizations
Tenant API key
Headers
Hex HMAC-SHA256 of the timestamp, the uppercase method, the url as sent and the request body, keyed by the signing secret.
Unix seconds. Checked before the signature.
Unique key for this write. A replay returns the stored response; the same key with a different body conflicts.

