Tenant Configuration
Everything needed to configure and operate a tenant. A **tenant** is an isolated workspace on The Wallet Crew platform — typically one brand, one region, or one programme. These endpoints manage the devices, scheduled tasks, secrets, API credentials, tenant settings, and webhook subscriptions that define how a tenant behaves.
Everything needed to configure and operate a tenant. A tenant is an isolated workspace on The Wallet Crew platform — typically one brand, one region, or one programme. These endpoints manage the devices, scheduled tasks, secrets, API credentials, tenant settings, and webhook subscriptions that define how a tenant behaves.
Devices
Devices are the scanners and terminals authorised to connect to Pass Scanner — the companion app used by staff to validate passes in real time.
GET /api/{tenantId}/devices
List registered devices. Requires Device.Read.
POST /api/{tenantId}/devices
Register a new device.
PUT /api/{tenantId}/devices/{deviceId}
Update device name or settings.
DELETE /api/{tenantId}/devices/{deviceId}
Remove a device and revoke its API key.
POST …/devices/{deviceId}/connect
Connect a device: returns its API key and environment URI.
POST …/devices/{deviceId}/connections/reset
Rotate the API key for a device.
See Manage devices guide for the full setup flow including QR code distribution.
Automations
An automation is a scheduled background task — data sync, pass updates, report exports, and more — running on a configurable cadence.
GET /api/{tenantId}/admin/automations
List every configured automation. Requires ConfigurationAutomation.Read.
GET /api/{tenantId}/admin/automations/{automationId}
Retrieve a single automation.
POST /api/{tenantId}/admin/automations
Create an automation. Requires ConfigurationAutomation.Write.
PUT /api/{tenantId}/admin/automations/{automationId}
Replace an automation in full; the id is immutable.
DELETE /api/{tenantId}/admin/automations/{automationId}
Delete an automation; its execution history stays queryable.
GET /api/{tenantId}/admin/automations/executions
List recent executions across all automations. Requires ConfigurationAutomation.Read.
GET /api/{tenantId}/admin/automations/{taskId}/executions
Execution history for a specific automation.
GET /api/{tenantId}/admin/automations/{taskId}/executions/{executionId}
Full detail and logs for a single execution.
POST /api/{tenantId}/admin/automations/{taskId}/reset
Reset an automation's internal state. Requires ConfigurationAutomation.Write.
Sftp
Read-only visibility into the SFTP (Triglav) flat-file import feature. Customers drop CSV files via SFTP to bulk-update passes; these endpoints report whether the feature is enabled for the tenant, list the files in its inbox, and return the full import story for one file — including which specific passes were touched and which failed.
GET /api/{tenantId}/admin/sftp/status
Whether SFTP is enabled, plus a quick activity summary.
GET /api/{tenantId}/admin/sftp/files
List inbox files, each tagged pending, processed, or error.
GET /api/{tenantId}/admin/sftp/files/{fileName}/log
Full import log for one file, including per-pass outcomes.
A tenant with no SFTP inbox simply has the feature disabled — every endpoint reports this as
sftpEnabled: false/ an empty list, never a 404.
Secret
Secrets are tenant-scoped key/value pairs used to store integration credentials (API tokens, signing keys, passwords) that connector scripts and configuration can reference without embedding secrets in plain text.
GET /api/{tenantId}/secrets
List all secret keys (values are not returned). Requires Secret.Read.
GET /api/{tenantId}/secrets/{key}
Retrieve a secret value by key.
PUT /api/{tenantId}/secrets/{key}
Create or update a secret.
DELETE /api/{tenantId}/secrets/{key}
Delete a secret.
Security
The Security tag manages API keys — the credentials used to authenticate calls to the tenant API.
GET /api/{tenantId}/admin/apiKeys
List all API keys for the tenant.
POST /api/{tenantId}/admin/apiKeys
Create a new key. The plaintext token is returned once at creation.
PUT /api/{tenantId}/admin/apiKeys/{keyName}
Update key metadata (name, scopes, expiry).
DELETE /api/{tenantId}/admin/apiKeys/{keyName}
Revoke and delete a key.
Each API key carries a set of permission scopes. A key without the required scope returns
403. Use the principle of least benefit — give integrations only the scopes they need.
Tenant
Tenant endpoints manage the configuration files that define how a tenant is set up — templates, layout overrides, branding, connector settings.
GET /api/tenants
List all tenants (Global Administrator only).
GET /api/tenants/{tenantId}
Download the full tenant configuration as a ZIP archive.
PUT /api/tenants/{tenantId}
Create or replace tenant configuration files.
PATCH /api/tenants/{tenantId}
Partially update specific configuration files.
DELETE /api/tenants/{tenantId}
Delete tenant configuration (Global Administrator only).
GET /api/tenants/{tenantId}/config/history
View the configuration change history.
GET /api/tenants/{tenantId}/test
Validate the tenant configuration without publishing.
TenantConfiguration
Higher-level tenant settings — programme name, locale defaults, custom domain, and platform-wide toggles.
WebHook
Webhooks deliver real-time HTTP notifications to your endpoint whenever events occur in The Wallet Crew — pass installed, pass updated, scan recorded, customer created, and more.
POST /api/{tenantId}/webhooks
Create a webhook subscription. Returns the id and a signatureSecret.
GET /api/{tenantId}/webhooks
List subscriptions.
PATCH /api/{tenantId}/webhooks/{id}
Update a subscription (URL, events, active state).
DELETE /api/{tenantId}/webhooks/{id}
Remove a subscription.
Verifying delivery: Every webhook request includes these headers:
x-neostore-signature
HMAC-SHA256 over the raw request body, using the signatureSecret.
x-neostore-eventname
The event type that triggered the delivery.
x-neostore-tenantid
The tenant that emitted the event.
Further reading
Last updated