> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zupy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate (use) a coupon

> Atomically mark a coupon as used, creating an activity record. Prevents double-usage via select_for_update. Auto-expires coupons past valid_until.



## OpenAPI

````yaml /api-reference/openapi.json post /api/v2/customers/{id}/coupons/{coupon_id}/validate/
openapi: 3.0.3
info:
  title: Zupy API v2
  version: 2.0.0
  description: >-
    Zupy API v2 — versioned, gateway-aware API with envelope responses, RFC 7807
    errors, and multi-auth support (JWT, API Key, Device Key).
servers:
  - url: https://api.zupy.com
    description: Production
security: []
tags:
  - name: Authentication
    description: OTP request and verification endpoints
  - name: Customers
    description: Customer management, points, history, and data operations
  - name: Loyalty Programs
    description: Loyalty program configuration and details
  - name: Rewards
    description: Loyalty reward catalog (definitions redeemed with points)
  - name: Companies
    description: Company information and loyalty configuration
  - name: Coupons
    description: >-
      Issued coupons (RewardRedemption) — both loyalty-reward redemptions and
      marketing claims
  - name: Wallet
    description: Apple Wallet pass generation and notifications
  - name: Webhooks
    description: Partner integration webhook endpoints
  - name: Webhook Management
    description: Configure and test outbound webhook delivery
paths:
  /api/v2/customers/{id}/coupons/{coupon_id}/validate/:
    post:
      tags:
        - Customers
      summary: Validate (use) a coupon
      description: >-
        Atomically mark a coupon as used, creating an activity record. Prevents
        double-usage via select_for_update. Auto-expires coupons past
        valid_until.
      operationId: customers_coupons_validate_create
      parameters:
        - in: path
          name: coupon_id
          schema:
            type: string
          required: true
          description: >-
            Accepts EITHER the RewardRedemption KSUID (e.g.
            `16a33f27fbbc1801d63d56d2027`) OR the customer-facing coupon_code
            (e.g. `CZ-914F15F3` or `CP-LEGACY01`). Lookup by code is
            case-insensitive — both `CZ-914F15F3` and `cz-914f15f3` resolve to
            the same coupon. The response always echoes the canonical upper-case
            form.
        - in: path
          name: id
          schema:
            type: string
          description: Unique identifier for this customer.
          required: true
        - name: X-OTP-Session
          in: header
          required: false
          schema:
            type: string
          description: >-
            OTP session token returned by POST /auth/verify-otp/. REQUIRED when
            the company's integration OTP policy enables it
            (require_otp_for_redemption for redeem, require_otp_for_coupon_usage
            for validate). Omitting it returns 403 with code "otp-required".
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CouponValidateResponse'
          description: ''
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: ''
      security:
        - apiKeyAuth: []
components:
  schemas:
    CouponValidateResponse:
      type: object
      description: >-
        Coupon validation result with current status, remaining usages, and a
        settled-state snapshot of the customer's balances. Story W.x: response
        now mirrors RewardRedeemResponse — partners get customer_id +
        new_balance + new_z_balance without a follow-up GET.
      properties:
        customer_id:
          type: string
          description: Customer KSUID (matches the {id} in the URL path).
        coupon_code:
          type: string
        status:
          type: string
          enum:
            - validated
        remaining_usages:
          type: integer
        total_usages_allowed:
          type: integer
        validated_at:
          type: string
          format: date-time
        new_balance:
          type: integer
          description: >-
            Customer's points balance after validation. Validate itself debits 0
            pts (points were spent at redemption time); this is the current
            balance so partners don't need an extra GET /customers/{id}/points/
            to confirm settled state.
        new_z_balance:
          type: string
          format: decimal
          description: >-
            Customer's current Z$ balance after validation, as a stringified
            Decimal with 6 places (matches the format used everywhere else in
            the API).
      required:
        - customer_id
        - coupon_code
        - new_balance
        - new_z_balance
        - remaining_usages
        - status
        - total_usages_allowed
        - validated_at
    Error:
      type: object
      description: RFC 7807 Problem Details error response.
      properties:
        type:
          type: string
          format: uri
        title:
          type: string
        status:
          type: integer
        detail:
          type: string
        instance:
          type: string
      required:
        - detail
        - instance
        - status
        - title
        - type
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: >-
        Per-company partner API key (zupy_pk_…). Validated by Zupy against the
        company integration key hash (Story 14.x); send it on every request as
        the X-API-Key header. Scoped read-write to the owning company's data.

````