Booking

Totals are always recomputed server-side from the room's pricing; a client-supplied amount is ignored. Ownership comes from the session, never from the body. The payment mode is validated against the venue's policy — a mode the venue does not offer is refused. Every booking holds its slot for 15 minutes and returns a clientSecret: the player's service fee (the amount is the quote's platformFeeCents) is charged online in all cases, plus the room price when the mode is online. The booking is only confirmed once the webhook reports the payment succeeded. Discount and gift voucher codes are redeemed inside the booking transaction and returned if the payment never completes. A signed-in booker may also say who is playing, as either a team booking (teamId — one of their own teams — and memberPlayerIds, the player.ids of the members coming, the booker left out) or a player booking (players, other players' public player IDs, and guests, names). The two are mutually exclusive. The booker is always a participant, taken from the session; team members picked are accepted at once, while a player named by ID is only invited and is credited with the outcome once they accept. Everyone named, the booker included, must fit in teamSize. An anonymous body that names anyone is refused. The venue's bookerPhone setting (on the room detail's venue) decides the phone: required refuses a booking without one that looks like a phone number, hidden drops any phone sent, and optional keeps whatever was sent, trimmed, with a blank phone stored as none. The response carries the quote the booking was actually written with — the same breakdown the PaymentIntent was built from — so the payment step never shows an amount taken from an earlier quote. An optional invoice object ("Need an invoice?": buyerKind business or person, name, vatNumber for an EU business, address, postalCode, city, country, email) is stored with the booking, in its transaction, for a Belgian venue only; an EU VAT number is checked with VIES first, and a VIES that does not answer never fails the booking. MTEC Games VOF's service fee invoice is emailed once the booking is confirmed.

Read-only: a discount or voucher code checked here is only reported as valid, never spent. The booking endpoint recomputes everything itself from the room's own pricing, so nothing returned from this endpoint is trusted back. This endpoint is unauthenticated, so a voucher code that exists but has no balance left is reported as VOUCHER_INVALID rather than VOUCHER_EMPTY — the distinction would confirm which guessed codes are real. POST /api/bookings keeps it.

Gives back the hold of a pending booking whose player left checkout, so the slot is free at once rather than when the 15-minute hold runs out, and cancels its PaymentIntent. A guest proves the booking is theirs with the PaymentIntent's clientSecret (from POST /api/bookings): its id must be the booking's PaymentIntent, and the secret must be the one Stripe holds. The signed-in booker may send {} instead. Anything else is a 404, never a 403, so a booking id cannot be probed. Whether the booking is unpaid is asked of Stripe, not read from its status: a payment that went through before its webhook landed counts as paid. Releasing a booking that is already cancelled answers 200 with it.

Where Bancontact, iDEAL and 3-D Secure redirects send the player back to. The PaymentIntent's clientSecret (from POST /api/bookings) is the proof, so it works without a session and from another device: its id must be a booking's PaymentIntent, and the secret must be the one Stripe holds. Anything else is a 404, never a 403. The secret is sent in the body so it stays out of the API's own access logs. intentStatus is Stripe's status for the payment, which can be succeeded while the booking is still pending until the webhook lands. No guest details are returned. room and venue carry only what the ticket prints and are read without the live filter, so a venue paused since still shows its ticket. cancellation is released for an unpaid hold given back and cancelled for a paid booking cancelled later, null otherwise. roomLive is whether the venue is live, so whether the room page still exists for players. party (the team name, the other players with a kind of member, invited or guest, and the registered players who could be invited to a team of the group) is sent only when the caller's player session is the booking's booker, else null.

Requires the caller to hold at least the admin venue role.

Requires the caller to hold at least the admin venue role.