> ## Documentation Index
> Fetch the complete documentation index at: https://tapcoupon.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Redeem points reward

> Spend points on a reward for a points card.

## POST `/points-card-rewards/redeem`

Spend points on a reward for a points card.

Send `Authorization: Bearer YOUR_API_KEY` and `X-Device-ID: YOUR_DEVICE_ID`. Also send `X-Employee-Token: YOUR_EMPLOYEE_TOKEN`. See [authentication](https://tapcoupon.mintlify.site/authentication.md).

Pass a reward id from [list rewards](https://tapcoupon.mintlify.site/api-reference/other/rewards.md). `pointsUsed` is the reward cost; `newPoints` is the remaining balance. Insufficient points return `400 INSUFFICIENT_POINTS`.

Cooldowns apply separately to each card and reward. A repeat redemption before the cooldown ends returns `409 REWARD_COOLDOWN`. Read [public card rewards](https://tapcoupon.mintlify.site/api-reference/cards/public-rewards.md) for `availableAt`. A cooldown of `0` disables the wait. Real-card reward redemptions generate a billing event.

### Card eligibility

The card must be activated, unarchived, unexpired, and valid for the API key's location. Test cards are usable only during the test period. Inactive cards return `422`, archived cards return `410`, and expired or location-mismatched cards return `400`.

`sessionToken` is optional. Supply it when completing a [partner payment session](https://tapcoupon.mintlify.site/integration.md). The session must be pending, unexpired, and support the card type. A successful operation completes it; an unsupported type returns `400`, and an unavailable session returns `410`.

Success messages can contain `$t(...)` translation expressions. Use the structured response fields to determine the outcome.

### Example request

```bash theme={null}
curl -X POST "https://tapcoupon.at/api/v1/points-card-rewards/redeem" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Device-ID: YOUR_DEVICE_ID" \
  -H "X-Employee-Token: YOUR_EMPLOYEE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "cardId": "9866191586296",
  "rewardId": "693869428d49e641ba110e18"
}'
```

### Example response

```json theme={null}
{
  "pointsUsed": 100,
  "newPoints": 50,
  "success": true,
  "message": "$t(pointsCardRewardRedeemed, {reward: Free coffee})"
}
```


## OpenAPI

````yaml api-reference/openapi.json POST /points-card-rewards/redeem
openapi: 3.1.0
info:
  title: TapCoupon POS and partner API
  version: 1.0.0
  description: >-
    API-key POS operations, customer card views, and partner payment sessions.
    Verified against the tap_coupon backend on 2026-10-02. Dashboard /clients
    and administrative routes use separate authentication and are outside this
    reference.
servers:
  - url: https://tapcoupon.at/api/v1
security: []
paths:
  /points-card-rewards/redeem:
    post:
      tags:
        - Cards
      summary: Redeem points reward
      description: Spend points on a reward for a points card.
      operationId: cards_redeem_reward
      parameters:
        - name: X-Device-ID
          in: header
          required: true
          description: Stable device identifier. API key binds to this value on first use.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                cardId:
                  type: string
                sessionToken:
                  type: string
                  description: Optional partner payment-session token.
                rewardId:
                  type: string
                  description: MongoDB object id.
                  pattern: ^[a-fA-F0-9]{24}$
              required:
                - cardId
                - rewardId
            example:
              cardId: '9866191586296'
              rewardId: 693869428d49e641ba110e18
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  pointsUsed:
                    type: integer
                  newPoints:
                    type: integer
                  success:
                    type: boolean
                  message:
                    type: string
              example:
                pointsUsed: 100
                newPoints: 50
                success: true
                message: '$t(pointsCardRewardRedeemed, {reward: Free coffee})'
        '400':
          description: Invalid request, card type, balance, points, or location.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: >-
            Missing or invalid API key, device id, employee token, or
            credentials.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: >-
            Device binding mismatch, archived location, employee location
            restriction, or account restriction.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Resource not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Reward cooldown is active.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '410':
          description: Card archived or payment session unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '422':
          description: Card inactive, fully used, or cannot be reconfigured.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: >-
            Rate limit exceeded. The response body is determined by the
            rate-limit middleware.
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - bearerAuth: []
          employeeToken: []
components:
  schemas:
    Error:
      type: object
      properties:
        error:
          type: string
          description: Human-readable error.
        errorCode:
          type: string
          description: >-
            Handler errors include a machine-readable code; middleware errors
            may omit it.
      required:
        - error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Location API key. Also requires X-Device-ID.
    employeeToken:
      type: apiKey
      in: header
      name: X-Employee-Token
      description: Employee session token from /employee/login.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.