Appearance
Product authentication
Source: routes/v1/authenticator_route.js → authenticator_controller.js
5.1 POST /api/v1/brand/mobile/verify/product/:authCode (guest) · POST /api/v1/user/mobile/verify/product/:authCode (customer)
Handler: verifyProductAndUpdateView — one handler, two mounts. Use the /user/ path when logged in so the scan is attributed.
Path: authCode ✅. Body: payload object required (may be empty {}):
| field | type | notes |
|---|---|---|
latitude, longitude | number | scan location |
nfc_identifier | string | lowercased; for NFC taps |
event_count | number | device event counter (puff count) |
Returns the product + the brl_id / pvl_id you need for step 5.2.
5.2 POST /api/v1/user/mobile/post_verify/product/:brl_id
Auth: Customer · Handler: postVerifyScanAuth — side-effects after a successful verify. Path: brl_id (integer) ✅. Body payload (whole body optional): pvl_id (int), event_count (int), nfc_identifier (string).
5.3 POST /api/v1/mobile/redeem-point/product
Auth: Customer · Handler: scanAuthAndClaimPoints Body payload: authCode ✅, plus optional customer object (firstName, lastName, fullName, password ≥8, email, phoneNumber ≥8, phone_prefix, dateOfBirth, tags, user_profile, user_description, username; needs email or phoneNumber). The customer object exists for the standalone/anonymous claim flow — with a customer token you can omit it. The mobile app never sends it: an unauthenticated scanner is routed into login first, so the claim always runs with a session. See the product authentication flow.
5.4 POST /api/v1/mobile/redeem-collectible/product
Auth: Customer · Handler: scanAuthAndClaimCollectible · Body payload: authCode ✅.
5.5 POST /api/v1/mobile/hold/points-collectible
Auth: Customer · Handler: holdPointsAndCollectible · Body payload: authCode ✅. Reserves the reward while a receipt/verification is pending.
5.6 POST /api/v1/mobile/release/points-collectible
Auth: Customer · Handler: releasePointsAfterVerify · Body payload: authCode ✅, receiptId (number, optional).
5.7 GET /api/v1/brand/mobile/verify/authcode/:authCode
Auth: Brand · Handler: verify_authcode · Path: authCode ✅. Lightweight validity check, no view log.
5.8 POST /api/v1/brand/mobile/verify/authcode-by-ocr
Auth: Brand · Handler: verify_authcode_by_ocrmultipart/form-data with a single file field named file (max 10 MB — see fileUpload config in app.ts). Runs OCR on the label image and resolves the auth code.