konfetti checkout API

openapi: 3.1.0
info:
  title: konfetti Store account checkout API
  version: v1
  x-generated: '2026-07-19'
  x-method: derived
  x-source: Derived by API Evangelist from direct observation of the live konfetti API at https://api.gokonfetti.com/v1 (every path and status code below was probed on 2026-07-19) plus the publicly served gokonfetti.com Nuxt application bundles under /_nuxt3/*.js, which name the endpoints, request bodies and query conventions the storefront uses. konfetti publishes no developer portal, no OpenAPI document and no API reference; this description is an honest reconstruction of the observable surface, not a provider-published specification. Nothing here is invented — schemas are modelled only from responses actually returned.
  description: 'konfetti (Konfetti GmbH, Berlin) operates a marketplace for bookable experiences, courses and workshops in Germany and Austria. The storefront at gokonfetti.com is a Nuxt 3 application backed by a JSON API served from api.gokonfetti.com — an Apiato/Laravel service exposing a `/v1/store/*` catalog namespace (public, unauthenticated read), a `/v1/checkout/*` and `/v1/user/*` namespace (Bearer-token authenticated), and an OAuth 2.0 token endpoint at `/v1/oauth/token`.

    This is an INTERNAL / UNDOCUMENTED API. konfetti does not market it as a public product, publishes no terms of use for it, and may change it without notice. Treat it as observational documentation, not a contract.'
  contact:
    name: konfetti (Konfetti GmbH)
    email: hallo@gokonfetti.com
    url: https://gokonfetti.com
  license:
    name: Proprietary — no public API terms published
servers:
- url: https://api.gokonfetti.com
  description: Production API host (observed HTTP 200, HTTP/2, Apiato/Laravel)
tags:
- name: checkout
  description: Cart validation, coupons and orders.
paths:
  /v1/store/coupon/{code}/validate:
    post:
      operationId: validateCoupon
      summary: Validate a coupon or voucher code against a cart
      description: POST-only (GET returned 405). Returns `data.coupon` and `data.discount`. The storefront treats HTTP 403 as "coupon no longer applies" and clears local coupon state.
      tags:
      - checkout
      parameters:
      - name: code
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                supplier_id:
                  type: string
                external:
                  type: boolean
                items:
                  type: array
                  items:
                    type: object
                source:
                  type: string
                  enum:
                  - KONFETTI
                  - EMBEDDED
                address:
                  type: object
      responses:
        '200':
          description: Coupon is valid; discount returned.
        '403':
          description: Coupon is not valid for this cart.
        '405':
          $ref: '#/components/responses/MethodNotAllowed'
  /v1/checkout/cart/validate:
    post:
      operationId: validateCart
      summary: Validate the current cart
      description: POST-only (GET returned 405). The storefront polls this every ten minutes while a cart is open to re-check availability and pricing.
      tags:
      - checkout
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                external:
                  type: boolean
                items:
                  type: array
                  items:
                    type: object
                    properties:
                      type:
                        type: string
                        enum:
                        - EVENT
                        - GIFT_CARD
                      quantity:
                        type: integer
      responses:
        '200':
          description: Cart is valid.
        '405':
          $ref: '#/components/responses/MethodNotAllowed'
  /v1/checkout/orders:
    get:
      operationId: listOrders
      summary: List the authenticated customer's orders
      description: Requires a Bearer access token; unauthenticated GET redirected (302) to the login page. The storefront calls it with `?orderBy=created_at&sortedBy=desc&page=N`.
      tags:
      - checkout
      security:
      - bearerAuth: []
      parameters:
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/orderBy'
      - $ref: '#/components/parameters/sortedBy'
      responses:
        '200':
          description: A page of orders.
        '302':
          description: Redirect to login when unauthenticated.
components:
  parameters:
    sortedBy:
      name: sortedBy
      in: query
      description: Sort direction applied to orderBy.
      schema:
        type: string
        enum:
        - asc
        - desc
    page:
      name: page
      in: query
      description: 1-based page number.
      schema:
        type: integer
        minimum: 1
        default: 1
    orderBy:
      name: orderBy
      in: query
      description: 'Comma-separated sort fields. Observed: `created_at`, `distance`, `has_events`, `has_promotion`, `trending_90_days`.'
      schema:
        type: string
  responses:
    MethodNotAllowed:
      description: HTTP method not allowed for this path.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Access token obtained from POST /v1/oauth/token and sent as `Authorization: Bearer <token>`.'
    oauth2:
      type: oauth2
      description: OAuth 2.0 token endpoint confirmed at /v1/oauth/token (League OAuth2 Server). No authorization endpoint, discovery document or scope reference is published, so no flows are enumerated here.
      flows: {}