Punchh Receipts API

openapi: 3.0.3
info:
  title: PAR Punchh Mobile Check-In Receipts API
  version: '1.0'
  description: The PAR Punchh Mobile API powers business-branded mobile apps and websites, exposing guest-facing loyalty functions such as user registration and sign-in, profile management, check-ins/transactions, and offer management. Access requires partner certification and business-issued OAuth client credentials. All calls are signed with an HMAC-SHA256 `x-pch-digest` header. Base URLs (sandbox and production) are provided by a Punchh representative.
  x-generated-from: documentation
  x-last-validated: '2026-06-03'
  contact:
    name: PAR Developer Portal
    url: https://developers.partech.com/
servers:
- url: https://{server_name}.punchh.com
  description: Punchh environment host (provided by your Punchh representative)
  variables:
    server_name:
      default: SERVER_NAME_GOES_HERE
      description: Environment-specific host name
tags:
- name: Receipts
  description: Receipt detail storage.
paths:
  /receipt_details:
    post:
      operationId: storeReceiptDetails
      summary: Store Receipt Details
      description: Stores itemized receipt details for a transaction.
      tags:
      - Receipts
      security:
      - PunchhPosToken: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
            examples:
              StorereceiptdetailsRequestExample:
                summary: Default storeReceiptDetails request
                x-microcks-default: true
                value: {}
      responses:
        '200':
          description: Receipt details stored.
        '401':
          description: Unauthorized.
      x-source-url: https://developers.partech.com/docs/dev-portal-pos/1fbfdfdd05a86-make-your-first-pos-api-call
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  securitySchemes:
    PunchhBearer:
      type: http
      scheme: bearer
      description: Bearer access token obtained via Sign In. Calls must also include an `x-pch-digest` HMAC-SHA256 signature header and a `punchh-app-device-id` header.
    PunchhDigest:
      type: apiKey
      in: header
      name: x-pch-digest
      description: HMAC-SHA256 request signature. Unauthenticated mobile calls also pass the business OAuth `client` id in the request body.