# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"
# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="POST"
PATH_AND_QUERY="$API_PATH/gateway/xp/redeem"
# One compact line, signed and sent unchanged. The server signs a
# re-serialization of the body it parsed, so reformatting this fails with a 401.
BODY='{"user_id":"YOUR_USER_ID","reward_id":"YOUR_REWARD_ID"}'
TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
| openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"
curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
-H "X-Tenant-Key: $KEY" \
-H "X-Tenant-Timestamp: $TIMESTAMP" \
-H "X-Tenant-Signature: $SIGNATURE" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: YOUR_IDEMPOTENCY_KEY" \
--data-binary "$BODY"const options = {
method: 'POST',
headers: {
'X-Tenant-Signature': '<x-tenant-signature>',
'X-Tenant-Timestamp': '<x-tenant-timestamp>',
'X-Idempotency-Key': '<x-idempotency-key>',
'x-tenant-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({reward_id: '<string>', user_id: '<string>', notes: '<string>'})
};
fetch('https://api.kintra.io/api/v1/gateway/xp/redeem', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.kintra.io/api/v1/gateway/xp/redeem"
payload = {
"reward_id": "<string>",
"user_id": "<string>",
"notes": "<string>"
}
headers = {
"X-Tenant-Signature": "<x-tenant-signature>",
"X-Tenant-Timestamp": "<x-tenant-timestamp>",
"X-Idempotency-Key": "<x-idempotency-key>",
"x-tenant-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"transaction": {
"amount": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"metadata": null,
"notes": "<string>",
"onchain_asset_id": "<string>",
"redemption_id": "<string>",
"tenant_id": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"blockchain_transaction_links": {
"blockchain_transaction": [
{
"id": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"metadata": null,
"receipt_block_hash": "<string>",
"receipt_block_number": "<string>",
"receipt_block_timestamp": 123,
"receipt_gas_price": "<string>",
"receipt_gas_used": "<string>",
"receipt_status": 123,
"receipt_transaction_index": 123,
"tx_data": "<string>",
"tx_from": "<string>",
"tx_gas_limit": "<string>",
"tx_gas_price": "<string>",
"tx_hash": "<string>",
"tx_max_fee_per_gas": "<string>",
"tx_max_priority_fee_per_gas": "<string>",
"tx_nonce": 123,
"tx_to": "<string>",
"tx_type": 123,
"tx_value": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
}
]
},
"onchain_asset": {
"asset_address": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"decimals": 123,
"deploy_tx_hash": "<string>",
"deployed_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"key": "<string>",
"metadata": null,
"name": "<string>",
"status": "<string>",
"symbol": "<string>",
"total_owners": 123,
"total_txns": 123,
"type": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
},
"reward": {
"id": "<string>",
"title": "<string>"
},
"tenant": {
"id": "<string>",
"name": "<string>",
"slug": "<string>"
},
"user": {
"email": "<string>",
"id": "<string>",
"username": "<string>"
}
}
},
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}Redeem a reward for a customer
Spends a customer’s XP on a reward. user_id and reward_id are required, notes is optional. Call it when a customer claims a reward you have published. The response data carries the transaction recorded for the spend, and the redemption it creates is readable through the redemption routes. X-Idempotency-Key is required: a missing key returns 400 IDEMPOTENCY_KEY_REQUIRED, and a replay of the same key returns the stored response rather than spending the customer’s XP twice. Reusing a key with a different request returns 422 IDEMPOTENCY_KEY_CONFLICT, and replaying a key whose first request is still in flight returns 409 with the same code. A first request that never recorded a response keeps returning 409 until the key ages out, so send a fresh key rather than retrying that one.
# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"
# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="POST"
PATH_AND_QUERY="$API_PATH/gateway/xp/redeem"
# One compact line, signed and sent unchanged. The server signs a
# re-serialization of the body it parsed, so reformatting this fails with a 401.
BODY='{"user_id":"YOUR_USER_ID","reward_id":"YOUR_REWARD_ID"}'
TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
| openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"
curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
-H "X-Tenant-Key: $KEY" \
-H "X-Tenant-Timestamp: $TIMESTAMP" \
-H "X-Tenant-Signature: $SIGNATURE" \
-H "Content-Type: application/json" \
-H "X-Idempotency-Key: YOUR_IDEMPOTENCY_KEY" \
--data-binary "$BODY"const options = {
method: 'POST',
headers: {
'X-Tenant-Signature': '<x-tenant-signature>',
'X-Tenant-Timestamp': '<x-tenant-timestamp>',
'X-Idempotency-Key': '<x-idempotency-key>',
'x-tenant-key': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({reward_id: '<string>', user_id: '<string>', notes: '<string>'})
};
fetch('https://api.kintra.io/api/v1/gateway/xp/redeem', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.kintra.io/api/v1/gateway/xp/redeem"
payload = {
"reward_id": "<string>",
"user_id": "<string>",
"notes": "<string>"
}
headers = {
"X-Tenant-Signature": "<x-tenant-signature>",
"X-Tenant-Timestamp": "<x-tenant-timestamp>",
"X-Idempotency-Key": "<x-idempotency-key>",
"x-tenant-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"success": true,
"data": {
"transaction": {
"amount": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"metadata": null,
"notes": "<string>",
"onchain_asset_id": "<string>",
"redemption_id": "<string>",
"tenant_id": "<string>",
"updated_at": "2023-11-07T05:31:56Z",
"user_id": "<string>",
"blockchain_transaction_links": {
"blockchain_transaction": [
{
"id": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"metadata": null,
"receipt_block_hash": "<string>",
"receipt_block_number": "<string>",
"receipt_block_timestamp": 123,
"receipt_gas_price": "<string>",
"receipt_gas_used": "<string>",
"receipt_status": 123,
"receipt_transaction_index": 123,
"tx_data": "<string>",
"tx_from": "<string>",
"tx_gas_limit": "<string>",
"tx_gas_price": "<string>",
"tx_hash": "<string>",
"tx_max_fee_per_gas": "<string>",
"tx_max_priority_fee_per_gas": "<string>",
"tx_nonce": 123,
"tx_to": "<string>",
"tx_type": 123,
"tx_value": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
}
]
},
"onchain_asset": {
"asset_address": "<string>",
"chain_id": 123,
"created_at": "2023-11-07T05:31:56Z",
"decimals": 123,
"deploy_tx_hash": "<string>",
"deployed_at": "2023-11-07T05:31:56Z",
"id": "<string>",
"key": "<string>",
"metadata": null,
"name": "<string>",
"status": "<string>",
"symbol": "<string>",
"total_owners": 123,
"total_txns": 123,
"type": "<string>",
"updated_at": "2023-11-07T05:31:56Z"
},
"reward": {
"id": "<string>",
"title": "<string>"
},
"tenant": {
"id": "<string>",
"name": "<string>",
"slug": "<string>"
},
"user": {
"email": "<string>",
"id": "<string>",
"username": "<string>"
}
}
},
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}{
"success": true,
"data": null,
"errors": [
{
"message": "<string>",
"path": "<string>"
}
],
"message": "<string>"
}Authorizations
Tenant API key
Headers
Hex HMAC-SHA256 of the timestamp, the uppercase method, the url as sent and the request body, keyed by the signing secret.
Unix seconds. Checked before the signature.
Unique key for this write. A replay returns the stored response; the same key with a different body conflicts.

