در حال بارگذاری…
Creates a check-in by redeeming a QR token displayed by the gym (see
issue check-in token). A live gym-side token is the gym's attestation, so
gym_approved is always true. user_approved is true only when the caller is the
subscriber: the intended athlete-scans-the-kiosk flow, which therefore records a mutually approved
visit in one call. A gym admin redeeming on a member's behalf records user_approved: false: minting
and redeeming a token are the same permission, so the gym cannot be allowed to assert the athlete's
side of a visit. The manual check-in derives both flags from the caller in the same way.
Same as manual check-in: the subscriber themselves, or a gym admin holding the
delegated gym_subscriptions.checkin permission.
| Name | Type | Required |
|---|
| Description |
|---|
| Example |
|---|
| gym-id | int | Yes | ID of the gym | 123 |
| subscription-id | int | Yes | ID of the subscription | 456 |
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| token | string | Yes | The plaintext token scanned from the gym's QR code (max 64 chars) | "kW3n8b2Xq…" |
| notes | string | No | Optional note for the check-in (max 2000) | "Arrived late" |
{
"token": "kW3n8b2XqL0pT7vYcRfZ9aH1mJ4sD6eGuI5oPxQw",
"notes": "Arrived late"
}
Check-in is refused with 400 when the membership's expires_at is before today (a membership is usable through
its expiry date; null never expires) or when its available_sessions_count is 0. Otherwise a check-in uses one
session: the count goes down by one, unless it is null (unlimited). Deleting a check-in gives
the session back (a check-in from before then spent none, so it refunds none). Before 2026-10-20 check-in ignored both fields and the count never moved.
Returns the created check-in resource with both approval flags true. The gym owner is notified.
For a full schema, see Gym Subscription Check-in Resource.
| Status | Description | Reference |
|---|---|---|
| 404 | Gym and subscription do not match | |
| 400 | An open check-in already exists | |
| 400 | Invalid token: expired, tampered, or issued for another gym (one message for all three) | |
| 400 | Membership expired (expires_at before today): "This membership has expired." | |
| 400 | No sessions left (available_sessions_count is 0): "This membership has no sessions left." | |
| 403 | Forbidden (no permission) | Permission error |
| 401 | Unauthorized | Authentication error |
| 422 | Validation error | Validation error |
| 429 | Throttled (10/min) |