Redeem a reward for a customer
Redeem a reward using points (default) or Z topping (use_z_tokens=true). Delegates to LoyaltyUserService or MultiPaymentRewardService. All async side effects (wallet card, Z split, notifications) preserved.
Authorizations
Per-company partner API key (zupy_pk_…). Validated by Zupy against the company integration key hash (Story 14.x); send it on every request as the X-API-Key header. Scoped read-write to the owning company's data.
Headers
OTP session token returned by POST /auth/verify-otp/. REQUIRED when the company's integration OTP policy enables it (require_otp_for_redemption for redeem, require_otp_for_coupon_usage for validate). Omitting it returns 403 with code "otp-required".
Body
Reward redemption request parameters.