> ## Documentation Index
> Fetch the complete documentation index at: https://docs.musterbox.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Mint a one-time PIN session (SDK-mediated)

> Starts the secure purchase flow. The SDK runs an environment integrity
check first; when any risk is detected the purchase is **blocked
client-side** (no request is sent) and an `ENV_COMPROMISED` security
event is reported.

This endpoint is part of the on-device purchase bridge and should be
driven exclusively through the SDK's `PurchaseClient`. Payload shapes
mirror the backend `SecurityController`.




## OpenAPI

````yaml /openapi/musterbox-public.yaml post /api/v1/security/pin-session
openapi: 3.0.3
info:
  title: MusterBox Public API
  version: 1.0.0
  description: |
    The public surface of the MusterBox developer platform. Every path in this
    document is verified against the MusterBox backend source code. The client
    SDK (`MusterBoxSdk`) is the recommended way to drive these endpoints; these
    pages document the wire contract for teams that need to understand or
    debug the traffic the SDK produces.

    Environments are selected by the base URL. The control-plane base URL per
    environment is:

    | Environment  | Base URL                          |
    | ------------ | --------------------------------- |
    | `local`      | `http://localhost:8081`           |
    | `sandbox`    | `https://sandbox-api.musterbox.dev` |
    | `staging`    | `https://staging-api.musterbox.dev` |
    | `production` | `https://api.musterbox.com`       |

    All paths below include the `api/v1` backend prefix explicitly, matching
    how the SDK resolves URLs (`control plane base` + `/api/v1`).

    > **Security boundary**: authentication, game sessions and results are the
    > only integration surfaces. Purchase endpoints exist for the on-device
    > PIN-verification flow and should always be driven through the SDK's
    > `PurchaseClient` — never hand-rolled. Do not roll your own purchase flow.
servers:
  - url: https://api.musterbox.com
    description: Production (default)
  - url: https://sandbox-api.musterbox.dev
    description: Sandbox — pre-production validation
  - url: https://staging-api.musterbox.dev
    description: Staging — pre-release integration environment
  - url: http://localhost:8081
    description: Local development backend
security:
  - bearerAuth: []
tags:
  - name: Authentication
    description: Player login, session refresh, and logout via the backend auth API
  - name: Game SDK
    description: >-
      Match sessions and mutually-confirmed results for games hosted by
      MusterBox
  - name: Secure purchases
    description: SDK-mediated PIN sessions for secure player purchases
paths:
  /api/v1/security/pin-session:
    post:
      tags:
        - Secure purchases
      summary: Mint a one-time PIN session (SDK-mediated)
      description: |
        Starts the secure purchase flow. The SDK runs an environment integrity
        check first; when any risk is detected the purchase is **blocked
        client-side** (no request is sent) and an `ENV_COMPROMISED` security
        event is reported.

        This endpoint is part of the on-device purchase bridge and should be
        driven exclusively through the SDK's `PurchaseClient`. Payload shapes
        mirror the backend `SecurityController`.
      operationId: mintPinSession
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - env_integrity_payload
              properties:
                env_integrity_payload:
                  type: object
                  required:
                    - risks
                    - level
                    - platform
                    - sdkVersion
                  properties:
                    risks:
                      type: array
                      description: Detected environment risks (empty when clean).
                      items:
                        type: string
                      example: []
                    level:
                      $ref: '#/components/schemas/IntegrityLevel'
                    platform:
                      type: string
                      description: Platform family reported by the SDK.
                      example: macos
                    sdkVersion:
                      type: string
                      description: Client SDK semantic version.
                      example: 1.0.0
                    details:
                      type: object
                      description: Free-form device detail forwarded verbatim.
                    itemId:
                      type: string
                      description: Marketplace item the player is purchasing.
                      example: item-arena-bundle
                    amount:
                      type: number
                      description: Purchase amount.
                      example: 9.99
      responses:
        '200':
          description: A one-time PIN session ready for verification.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PinSession'
        '401':
          description: Missing or invalid access token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      security:
        - bearerAuth: []
components:
  schemas:
    IntegrityLevel:
      type: string
      enum:
        - SAFE
        - WARN
        - COMPROMISED
    PinSession:
      type: object
      properties:
        sessionId:
          type: string
          description: Id used in the verify path.
        sessionToken:
          type: string
          description: Sent as the `x-secure-session` header during verification.
        expiresIn:
          type: integer
          format: int64
          description: Session lifetime in milliseconds.
        envLevel:
          $ref: '#/components/schemas/IntegrityLevel'
      required:
        - sessionId
        - sessionToken
    ApiError:
      type: object
      description: >-
        NestJS error envelope ({ error: { code, message, status } }) or the
        plain { message } shape.
      properties:
        error:
          type: object
          properties:
            code:
              type: string
            message:
              type: string
            status:
              type: integer
        message:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Player access token returned by login/refresh.

````