AllAccess API

Liveness check. Returns {"status": "ok"}.

Readiness check.

Creates a Keycloak user, sends the verification email, creates a Stripe customer, and returns an Embedded Checkout client_secret.

Body

{
  "first_name": "Ada",
  "last_name": "Lovelace",
  "email": "ada@example.com",
  "password": "<min 8 chars>"
}

Response

{
  "user_id": "f3a1...",
  "client_secret": "cs_test_..._secret_..."
}

Frontend mounts Stripe's Embedded Checkout with this client_secret.

Resends the Keycloak verification email. Returns {"ok": true} either way. If we 404'd on unknown emails it'd leak which addresses are members. Rate-limited 5/hr per IP.

{ "email": "ada@example.com" }

Kicks off Keycloak's "update password" required action and emails the user a link. Same silent-on-unknown-email behavior + rate limit as above.

{ "email": "ada@example.com" }

Profile + entitlements for the calling user.

{
  "id": "f3a1...",
  "email": "ada@example.com",
  "first_name": "Ada",
  "last_name": "Lovelace",
  "member_since": "2026-05-06",
  "end_date": "2027-05-05",
  "total_orders": 1,
  "allaccess": true,
  "seatclub": true,
  "trebel_max": true
}

Update first/last name. Returns the same shape as GET /me.

{ "first_name": "Ada", "last_name": "Lovelace" }

Just the entitlement flags. Useful when the SeatClub white-label or any other integrator wants the bare check.

{
  "end_date": "2027-05-05",
  "allaccess": true,
  "seatclub": true,
  "trebel_max": true
}

Returns a fresh Stripe Embedded Checkout client_secret. Used when the user is signed in but hasn't finished paying.

{ "client_secret": "cs_test_..._secret_..." }

Returns a Stripe Customer Portal URL. Drives the "Manage Plan" button. Stripe doesn't offer an embedded portal so this stays a redirect.

{ "url": "https://billing.stripe.com/p/session/..." }

Subscription details for the Settings page (status, next bill date, price). Returns {"subscription": null} if the user hasn't paid yet.

{
  "subscription": {
    "id": "sub_...",
    "status": "active",
    "current_period_end": 1773926400,
    "cancel_at_period_end": false,
    "amount": 14900,
    "currency": "usd",
    "interval": "year"
  }
}

Recent invoices for the order history page.

{
  "orders": [
    {
      "id": "in_...", "number": "AA-0001",
      "amount_paid": 14900, "currency": "usd",
      "status": "paid", "created": 1741200000,
      "hosted_invoice_url": "https://...", "invoice_pdf": "https://..."
    }
  ]
}

Stripe-signed webhook. Idempotent. Handled events:

• checkout.session.completed - link Stripe customer + subscription, set allaccess_enddate
• invoice.paid / invoice.payment_succeeded - bump allaccess_enddate
• invoice.payment_failed - log only, don't revoke
• customer.subscription.deleted - log. Entitlement expires naturally