> ## Documentation Index > Fetch the complete documentation index at: https://docs.getstell.com/llms.txt > Use this file to discover all available pages before exploring further. # Create secure Apple Wallet pass > Create a secure Apple Wallet pass with account binding and enhanced security. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/apple/passes/secure openapi: 3.0.1 info: title: Stell API description: >- Create and manage passes for Apple Wallet and Google Wallet. One API for loyalty programs, membership cards, tickets, and more. termsOfService: https://getstell.com/terms contact: name: Stell API Support url: https://getstell.com/about?topic=Technical%20Support#contact email: hello@getstell.com version: '2026-08-09T18:16:19Z' servers: - url: https://api.platform.getstell.com description: Production API security: - StellApiAuthorizer: [] tags: - name: Companies description: Manage companies at the top of your tenant hierarchy. - name: Merchants description: Manage brands and business units within companies. - name: Stores description: Manage store locations and customer touchpoints. - name: Programs description: Configure pass programs for loyalty, membership, tickets, and more. - name: Pass Templates description: Define pass design and field layouts. - name: Passes description: Issue and manage customer passes for Apple and Google Wallet. - name: Terminals description: Configure terminals for tap-to-scan functionality. - name: Transactions description: Track pass usage, purchases, and redemptions. - name: Engagement description: Geofences, notifications, and location-based engagement features. - name: System description: Health checks and service monitoring. paths: /v1/apple/passes/secure: post: tags: - Passes summary: Create secure Apple Wallet pass description: >- Create a secure Apple Wallet pass with account binding and enhanced security. operationId: createSecurePass requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateSecurePassModel' required: true responses: '201': description: 201 response content: application/json: schema: $ref: '#/components/schemas/SecurePassResponseModel' '400': description: 400 response content: application/json: schema: $ref: '#/components/schemas/Error400Model' '401': description: 401 response content: application/json: schema: $ref: '#/components/schemas/Error401Model' '403': description: 403 response content: application/json: schema: $ref: '#/components/schemas/Error403Model' '404': description: 404 response content: application/json: schema: $ref: '#/components/schemas/Error404Model' '500': description: 500 response content: application/json: schema: $ref: '#/components/schemas/Error500Model' security: - StellApiAuthorizer: [] components: schemas: CreateSecurePassModel: title: CreateSecurePassModel required: - programId type: object properties: creationSource: required: - type type: object properties: reference: type: string description: Optional transaction/request ID method: type: string description: Specific method/endpoint/action used type: type: string description: Creation method type enum: - APPLE_VAS - API - MANUAL - BULK - CRM additionalProperties: false description: Detailed tracking of how the pass was created templateOverrides: $ref: '#/components/schemas/TemplateOverridesModel' payload: type: string description: NFC or QR payload (defaults to pass ID if not provided) externalId: type: string description: External reference ID semanticTagOverrides: $ref: '#/components/schemas/SemanticTagsModel' membershipStatus: maxLength: 255 type: string description: >- Merchant-defined account status (e.g., "Active", "Suspended", "On Hold") programId: minLength: 1 type: string description: ID of the program to create pass for customer: type: object properties: firstName: type: string description: Customer first name lastName: type: string description: Customer last name emailAddress: type: string description: Customer email address for notifications format: email personalId: maxLength: 64 type: string description: >- National/personal identity number (e.g., Swedish personnummer). Optional. PII — sent only when required by merchant. lookupSource: maxLength: 50 pattern: ^[a-z0-9-]+$ type: string description: >- Which CRM was queried for new/existing determination (e.g., "voyado") phone: type: string description: Customer phone number (deprecated - use mobileNumber) mobileNumber: type: string description: Customer mobile phone number for SMS delivery isNew: type: boolean description: >- Whether the customer is new (not found in merchant CRM). Set at creation, immutable. email: type: string description: Customer email address (deprecated - use emailAddress) format: email description: Customer information description: Data for Apple secure pass with account binding. SecurePassResponseModel: title: SecurePassResponseModel required: - data - requestId type: object properties: data: required: - pass - secureUrl type: object properties: secureUrl: type: string description: >- Secure access URL cryptographically bound to the requesting device format: uri pass: required: - createdAt - id - programId - status - updatedAt type: object properties: createdAt: type: string description: When the pass was created format: date-time externalId: type: string description: External reference ID maxDistance: minimum: 1 type: integer description: Maximum distance in meters for location relevance id: type: string description: Unique pass identifier membershipStatus: maxLength: 255 type: string description: Merchant-defined membership status (max 255 characters) programId: type: string description: Parent program ID status: type: string description: Current pass status customer: type: object properties: firstName: type: string description: Customer first name lastName: type: string description: Customer last name emailAddress: type: string description: Customer email address personalId: maxLength: 64 type: string description: >- National/personal identity number (e.g., Swedish personnummer). Optional. PII — sent only when required by merchant. lookupSource: maxLength: 50 type: string description: Which CRM was queried for new/existing determination phone: type: string description: Customer phone number (deprecated - use mobileNumber) mobileNumber: type: string description: Customer mobile phone number isNew: type: boolean description: >- Whether the customer was new (not found in merchant CRM) at pass creation time email: type: string description: Customer email address (deprecated - use emailAddress) description: Customer information updatedAt: type: string description: When the pass was last updated format: date-time description: The created account-bound pass description: Created pass and its secure access URL requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging description: Apple secure pass creation response. Error400Model: title: Error400Model required: - error - requestId type: object properties: requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging error: required: - code - message type: object properties: code: type: string description: Machine-readable error code enum: - BAD_REQUEST details: type: object additionalProperties: true description: Additional error context message: type: string description: Human-readable error message default: Invalid request parameters description: Error information description: Bad request with validation details. Error401Model: title: Error401Model required: - error - requestId type: object properties: requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging error: required: - code - message type: object properties: code: type: string description: Machine-readable error code enum: - UNAUTHORIZED details: type: object additionalProperties: true description: Additional error context message: type: string description: Human-readable error message default: Authentication required description: Error information description: Authentication failed. Error403Model: title: Error403Model required: - error - requestId type: object properties: requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging error: required: - code - message type: object properties: code: type: string description: Machine-readable error code enum: - FORBIDDEN details: type: object additionalProperties: true description: Additional error context message: type: string description: Human-readable error message default: Access denied to this resource description: Error information description: Access denied. Error404Model: title: Error404Model required: - error - requestId type: object properties: requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging error: required: - code - message type: object properties: code: type: string description: Machine-readable error code enum: - NOT_FOUND details: type: object additionalProperties: true description: Additional error context message: type: string description: Human-readable error message default: Resource not found description: Error information description: Resource not found. Error500Model: title: Error500Model required: - error - requestId type: object properties: requestId: pattern: ^[0-9A-Z]{26}$ type: string description: Unique request identifier for debugging error: required: - code - message type: object properties: code: type: string description: Machine-readable error code enum: - INTERNAL_ERROR details: type: object additionalProperties: true description: Additional error context message: type: string description: Human-readable error message default: An internal server error occurred description: Error information description: Internal server error. TemplateOverridesModel: type: object properties: logoText: maxLength: 50 type: string description: Override logo text (max 50 characters) fieldOverrides: type: object properties: backFields: type: array description: Override back fields items: required: - key - value type: object properties: label: type: string description: >- Label shown above the value. Omit to keep the template label. value: type: string description: Value shown on the pass key: type: string description: >- Key of the template field to override. Unknown keys add a new field. description: One field override secondaryFields: type: array description: Override secondary fields items: required: - key - value type: object properties: label: type: string description: >- Label shown above the value. Omit to keep the template label. value: type: string description: Value shown on the pass key: type: string description: >- Key of the template field to override. Unknown keys add a new field. description: One field override mergeStrategy: type: string description: Strategy for merging field overrides enum: - REPLACE - MERGE - APPEND default: MERGE primaryFields: type: array description: Override primary fields items: required: - key - value type: object properties: label: type: string description: >- Label shown above the value. Omit to keep the template label. value: type: string description: Value shown on the pass key: type: string description: >- Key of the template field to override. Unknown keys add a new field. description: One field override headerFields: type: array description: Override header fields items: required: - key - value type: object properties: label: type: string description: >- Label shown above the value. Omit to keep the template label. value: type: string description: Value shown on the pass key: type: string description: >- Key of the template field to override. Unknown keys add a new field. description: One field override auxiliaryFields: type: array description: Override auxiliary fields items: required: - key - value type: object properties: label: type: string description: >- Label shown above the value. Omit to keep the template label. value: type: string description: Value shown on the pass key: type: string description: >- Key of the template field to override. Unknown keys add a new field. description: One field override description: Override pass fields with custom values images: type: object properties: footerImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: Footer image above the barcode (boarding passes). artworkImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: >- Poster artwork (poster event tickets). Apple Wallet only; there is no Google Wallet equivalent. logoImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: Logo shown in the pass header. iconImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: Icon used in notifications and on the lock screen. backgroundImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: Background image (event tickets and generic passes). stripImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: >- Strip image below the header. Also becomes the Google Wallet hero image. thumbnailImage: type: object properties: sourceUrl: maxLength: 2048 type: string description: >- Public HTTPS URL that Stell fetches, validates, resizes and stores. Provide exactly one of sourceUrl or uploadId. format: uri uploadId: maxLength: 512 type: string description: >- Opaque upload identifier returned by POST /v1/passes/image-uploads. Provide exactly one of sourceUrl or uploadId. additionalProperties: false description: Thumbnail image (generic passes and event tickets). additionalProperties: false description: >- Per-pass image overrides. Each slot accepts { "sourceUrl": "https://..." } or { "uploadId": "..." }. Set a slot to null to clear the override and fall back to the template image; omit a slot to keep its current value. On Google Wallet, stripImage becomes the hero image, and artworkImage is Apple Wallet only. overrideMetadata: type: object additionalProperties: true description: Additional metadata for override context overrideReason: maxLength: 100 type: string description: Reason for applying overrides (e.g., "Gold member", "VIP status") maxDistance: minimum: 1 type: integer description: >- Maximum distance (meters) for Apple Wallet location notifications. Overrides template/program defaults. Send null to clear and revert to template/program defaults. actions: type: object description: >- Pass-level featured actions. When non-empty, fully replaces the template actions array. Send null or an empty array to revert to the template actions. colors: type: object properties: backgroundColor: pattern: ^#[0-9A-Fa-f]{6}$ type: string description: Background color in hex format (e.g., "#FF0000") foregroundColor: pattern: ^#[0-9A-Fa-f]{6}$ type: string description: Foreground/text color in hex format stripColor: pattern: ^#[0-9A-Fa-f]{6}$ type: string description: Strip color in hex format labelColor: pattern: ^#[0-9A-Fa-f]{6}$ type: string description: Label color in hex format description: Override pass colors additionalProperties: false description: >- Template overrides for dynamic pass customization based on business logic (e.g., member tiers, promotions). All fields are optional. SemanticTagsModel: type: object properties: eventLiveMessage: maxLength: 500 type: string description: Real-time event status updates (iOS 18+) leagueAbbreviation: type: string description: Sports league abbreviation (e.g., NFL, MLB) venuePhoneNumber: type: string description: Venue contact phone number priorityStatus: type: string description: Priority boarding or check-in status tailgatingAllowed: type: boolean description: '' seats: maxItems: 10 type: array description: Seat assignments for events, flights, or venues items: type: object properties: seatIdentifier: maxLength: 50 type: string description: Unique seat identifier combining all components seatType: maxLength: 30 type: string description: Type or category of seat seatDescription: maxLength: 100 type: string description: Additional seat information seatSection: maxLength: 20 type: string description: Section identifier (e.g., Orchestra, Balcony, A) seatRow: maxLength: 10 type: string description: Row identifier (e.g., 12, A, Front) seatAisle: maxLength: 10 type: string description: Aisle identifier seatSectionColor: pattern: ^#[0-9A-Fa-f]{6}$ type: string description: Color code for section visualization seatNumber: maxLength: 10 type: string description: Seat number or identifier seatLevel: maxLength: 10 type: string description: Level or floor identifier additionalProperties: false description: One seat assignment attendeeName: maxLength: 100 type: string description: Full name of the attendee leagueName: type: string description: Sports league full name securityScreening: type: string description: Security screening type (e.g., TSA PreCheck) venueEntrance: type: string description: Venue entrance name or identifier destinationGate: maxLength: 10 type: string description: Arrival gate identifier balance: required: - amount - currencyCode type: object properties: amount: pattern: ^\d+(\.\d{1,2})?$ type: string description: Amount as string for precision (e.g., "150.75") currencyCode: pattern: ^[A-Z]{3}$ type: string description: ISO 4217 currency code (e.g., USD, EUR, GBP) additionalProperties: false description: Account balance for loyalty programs or stored value cards playlistIDs: type: array description: List of playlist identifiers items: type: string description: Playlist identifier eventName: maxLength: 200 type: string description: Name of the event vehicleNumber: type: string description: Vehicle or route number airplay: type: array description: AirPlay device configuration items: required: - airPlayDeviceGroupToken type: object properties: airPlayDeviceGroupToken: type: string description: Token for AirPlay device group identification description: One AirPlay device homeTeamLocation: type: string description: Home team city or location silenceRequested: type: boolean description: Whether silent mode is requested for notifications awayTeamAbbreviation: maxLength: 10 type: string description: Away team abbreviation for sports events departureAirportCode: pattern: ^[A-Z]{3}$ type: string description: IATA departure airport code vehicleType: type: string description: Type of vehicle (e.g., Bus, Train, Ferry) departurePlatform: maxLength: 20 type: string description: Train departure platform awayTeamLocation: maxLength: 50 type: string description: Away team city or location destinationLocationDescription: maxLength: 100 type: string description: Descriptive destination location boardingSequenceNumber: maxLength: 10 type: string description: Boarding sequence or position number venueEntrancePortal: type: string description: '' additionalTicketAttributes: maxLength: 200 type: string description: Additional ticket features and benefits destinationAirportName: maxLength: 100 type: string description: Full destination airport name membershipProgramNumber: type: string description: Member identification number venueOpenDate: type: string description: When the venue opens format: date-time eventType: type: string description: Category of event this pass is for enum: - PKEventTypeGeneric - PKEventTypeMovie - PKEventTypeConference - PKEventTypeConvention - PKEventTypeWorkshop - PKEventTypeSocialGathering - PKEventTypeSports - PKEventTypeLivePerformance admissionLevelAbbreviation: maxLength: 10 type: string description: Short form of admission level currentBoardingDate: type: string description: Updated boarding date and time format: date-time flightNumber: type: number description: Flight number without airline code artistIDs: type: array description: List of artist identifiers items: type: string description: Artist identifier carNumber: maxLength: 20 type: string description: Train car or vehicle number venueName: type: string description: Name of the venue or location eventStartDateInfo: required: - date type: object properties: date: type: string description: Event start date in ISO 8601 format ignoreTimeComponents: type: boolean description: Whether to ignore time components and use date only timeZone: type: string description: Time zone identifier (e.g., America/New_York) description: Event start date with timezone control confirmationNumber: maxLength: 50 type: string description: Booking or reservation confirmation number venueParkingLotsOpenDate: type: string description: When the venue parking lots open format: date-time originalBoardingDate: type: string description: Originally scheduled boarding date and time format: date-time awayTeamName: maxLength: 50 type: string description: Full away team name albumIDs: type: array description: List of album identifiers items: type: string description: Album identifier destinationPlatform: maxLength: 20 type: string description: Train arrival platform homeTeamAbbreviation: type: string description: Home team abbreviation (e.g., NYY) sportName: type: string description: Name of the sport departureAirportName: maxLength: 100 type: string description: Full departure airport name venueLocation: required: - latitude - longitude type: object properties: latitude: maximum: 90 minimum: -90 type: number description: Latitude in decimal degrees longitude: maximum: 180 minimum: -180 type: number description: Longitude in decimal degrees additionalProperties: false description: Venue location coordinates for events and venues wifiAccess: type: array description: WiFi network information items: required: - password - ssid type: object properties: password: type: string description: WiFi network password ssid: type: string description: WiFi network name (SSID) description: One WiFi network eventStartDate: type: string description: When the event starts format: date-time passengerName: type: object properties: namePrefix: maxLength: 10 type: string description: Name prefix (Mr., Ms., Dr., etc.) familyName: maxLength: 50 type: string description: Last name/surname givenName: maxLength: 50 type: string description: First name nickname: maxLength: 30 type: string description: Preferred name or nickname nameSuffix: maxLength: 10 type: string description: Name suffix (Jr., Sr., III, etc.) middleName: maxLength: 30 type: string description: Middle name or initial phoneticRepresentation: maxLength: 100 type: string description: Phonetic spelling for pronunciation additionalProperties: false description: Passenger name components for boarding passes destinationAirportCode: pattern: ^[A-Z]{3}$ type: string description: IATA destination airport code vehicleName: type: string description: Name of the vehicle or service entranceDescription: maxLength: 200 type: string description: Description of the entrance location (iOS 18+) departureGate: maxLength: 10 type: string description: Departure gate identifier totalPrice: required: - amount - currencyCode type: object properties: amount: pattern: ^\d+(\.\d{1,2})?$ type: string description: Amount as string for precision (e.g., "29.99") currencyCode: pattern: ^[A-Z]{3}$ type: string description: ISO 4217 currency code (e.g., USD, EUR, GBP) additionalProperties: false description: Total price for transactions or purchases venueEntranceGate: type: string description: '' venueRoom: type: string description: Room or hall within the venue venueFanZoneOpenDate: type: string description: When the venue fan zone opens format: date-time venueBoxOfficeOpenDate: type: string description: '' format: date-time destinationLocation: required: - latitude - longitude type: object properties: latitude: maximum: 90 minimum: -90 type: number description: Latitude in decimal degrees longitude: maximum: 180 minimum: -180 type: number description: Longitude in decimal degrees additionalProperties: false description: Destination location coordinates for transit passes departureLocationDescription: maxLength: 100 type: string description: Descriptive departure location originalDepartureDate: type: string description: Originally scheduled departure date and time format: date-time duration: type: number description: Duration in seconds boardingGroup: maxLength: 20 type: string description: Flight boarding group identifier currentDepartureDate: type: string description: Updated departure date and time format: date-time destinationTerminal: maxLength: 20 type: string description: Airport arrival terminal genre: type: string description: Event genre or category airlineCode: pattern: ^[A-Z0-9]{2,3}$ type: string description: IATA airline code (2-3 characters) currentArrivalDate: type: string description: Updated arrival date and time format: date-time admissionLevel: maxLength: 50 type: string description: Access level or tier originalArrivalDate: type: string description: Originally scheduled arrival date and time format: date-time eventEndDate: type: string description: When the event ends format: date-time departureTerminal: maxLength: 20 type: string description: Airport departure terminal membershipProgramName: type: string description: Name of the membership or loyalty program transitProvider: type: string description: Transit company or provider name departureLocation: required: - latitude - longitude type: object properties: latitude: maximum: 90 minimum: -90 type: number description: Latitude in decimal degrees longitude: maximum: 180 minimum: -180 type: number description: Longitude in decimal degrees additionalProperties: false description: Departure location coordinates for transit passes flightCode: type: string description: Airline IATA code (e.g., AA for American Airlines) transitStatusReason: type: string description: Reason for transit status if delayed or canceled venueGatesOpenDate: type: string description: When the venue gates open format: date-time venueEntranceDoor: type: string description: '' performerNames: type: array description: List of performer names items: type: string description: Performer name venueDoorsOpenDate: type: string description: '' format: date-time transitStatus: type: string description: Current transit status (e.g., On Time, Delayed) venueRegionName: type: string description: '' departureStationName: maxLength: 100 type: string description: Departure station name homeTeamName: type: string description: Home team full name destinationStationName: maxLength: 100 type: string description: Destination station name venueCloseDate: type: string description: '' format: date-time additionalProperties: false description: >- Semantic tags for Apple Wallet passes: seating, flight, event and location details that Wallet and Siri use for suggestions. All fields are optional; send the ones that apply to your pass type. securitySchemes: StellApiAuthorizer: type: http scheme: bearer bearerFormat: API Key description: |- API key authentication. Include your API key as a Bearer token. Example: `Bearer sk_prod_xxxxxx` Get your API key from the Stell Dashboard. ````