Retrieve the order behind a signed confirmation reference
Call this from your backend after the shopper returns from the hosted checkout to your confirmation page with ?ref=<cart id>&sig=<signature>: pass both on unchanged to read the order, with its tickets when it has any (ticketsUnavailable: true instead means they could not be read right now, so retry). Requires an access token in the Authorization header, from POST /oauth/token, issued for the store in x-entria — so call it from a backend, never a browser. A 202 means no order exists for this reference yet. It does NOT confirm that payment succeeded: the reference exists before payment, so a refused or abandoned payment also answers 202, and keeps answering it. Poll a bounded number of times over a bounded window, then stop and show a neutral message — such as asking the shopper to check their email for a confirmation — never a success. Reads are repeatable.
Check the reference is your visitor’s before you show the order. ref/sig stay in the page URL — browser history, shared links, the Referer your page sends — and this endpoint answers them for as long as the order exists, tickets included. Anyone who opens that URL makes your backend read the order for them. Show it only when ref is the cart id this visitor’s own session created (you get it from POST /api/cart before sending them to checkoutUrl); failing that, when the order’s email matches the one your session collected.
Authentication
OAuth client token, for a partner backend only. A short-lived access token for endpoints that return personal data about any member. Obtain one from POST /oauth/token (RFC 7523 JWT-bearer), signing the assertion with the private key of the key pair registered for your store. Sent as Authorization: Bearer <token>. This is separate from the x-entria store header, which is still required.
Headers
Identifies which store this request is for. Required on every store-scoped route. It is not authentication and not a secret — it grants no privileges and is safe to send from a browser. You receive the value once your Entria backend has been created and configured. Missing header returns 400; an unknown store returns 404.
Query parameters
The ref your confirmation page received: the cart id.
The sig your confirmation page received alongside ref.
Response
The order, with its tickets when it has any — or ticketsUnavailable: true when they could not be read.
Entria order (default fields plus email and promotions), with sensitive metadata removed and payment-provider data narrowed to public keys. Only the fields listed here are documented; the response carries more (items, subtotals, billing_address, payment_collections, summary, metadata, …).