Changelog

Changes to the XQUARE API and webhooks, newest first.

v1 — expanding

How long a retired api_version keeps working has not been set yet. It will be stated here before any version is retired.

2026-10-28

Webhook endpoints from code: GET/POST /v1/webhook-endpoints, GET/PATCH/DELETE /v1/webhook-endpoints/{id} and POST /v1/webhook-endpoints/{id}/test, with the scopes webhook_endpoints:read and webhook_endpoints:manage. See Manage endpoints from code.

First version of these pages: the guides for POS, CRM, gate scanner and webhook receivers, plus errors, rate limits, retries and the webhook event list.

Vouchers: POST /v1/vouchers/validate, POST /v1/vouchers/redeem, GET /v1/vouchers.
GET /v1/voucher-templates and GET /v1/space.

Events and ticket check-ins: GET /v1/events, POST /v1/events/{id}/check-ins.
Sponsor packages (read): GET /v1/sponsor-packages, GET /v1/sponsor-packages/{id}.
Credits (read): GET /v1/credits, GET /v1/credits/ledger.

The v1 spec is released (api-v1.0.0). The API reference is generated from it. Operations added after this date may still be labelled "planned" there until the next spec release.
Base URL https://api.xquare.net/v1 with xq_live_ keys, sent as a bearer token. Each key has scopes.
Sponsor redemptions: POST /v1/sponsor-packages/{id}/redemptions.
Idempotency-Key on every POST, replayed for 24 hours.
Webhooks are signed with X-XQ-Signature: v1= (HMAC-SHA256). A failed delivery gets up to 8 attempts over about 44.6 hours.

Not yet available: the sandbox (api-sandbox.xquare.net). (/v1/webhook-endpoints followed on 2026-10-28.)