# Agent Dune Tickets

Headless ticketing for Dune: Part Three at AMC Lincoln Square 13,
New York, auditorium 13, IMAX 70mm. All times include timezone offsets; display
them in America/New_York.

Discovery: GET /openapi.json and GET /v1/showtimes.
Live sales monitor: GET /sales shows the current seat map and sales counts,
refreshing every 15 seconds without exposing buyer information.
UCP discovery: GET /.well-known/ucp (2026-08-25); integration guide: GET /ucp/guide.
UCP checkout REST operations are at /ucp/checkout-sessions. Platforms need
authorized trusted-server credentials and a UCP-Agent profile; see /ucp/guide.
Showtimes include venue, google_place_id, address, maps_url and timezone.
Use google_place_id to match the venue to your places catalog.
Inventory: GET /v1/showtimes/{id}/listings.
Visual selection: GET /v1/showtimes/{id}/seatmap.png returns an image/png graphic.
GET /v1/showtimes/{id}/seatmap returns JSON seat data and a png_url.
GET /v1/venue/seatmap[.png] defaults to the next published screening's availability.
Append ?selected=H21,H22 to highlight exact seats. Embed the returned PNG URL in
your conversation with the showtime, seat IDs and all-in price. Graphics do not
create holds. Unavailable seats cannot be reserved.
Colors: available = grey; taken/unavailable = red X; selected = yellow;
seats purchased by the current buyer = green. Public maps show sold seats as taken.
The acquired private screening is December 15, 2026: doors 2 PM, film 2:30 PM ET.
All listed seats cost $30. The catalog offers 472 non-wheelchair seat choices
subject to a shared 470-ticket cap. Companion seats retain their designation.
The published inventory is real. The map source describes only diagram geometry;
listing IDs and availability from this service identify the seats offered for sale.

Suggestions: GET /v1/showtimes/{id}/recommendations?quantity=2&preference=center.
Every recommendation contains available, published listing IDs and a current total.
Use inventory_status, state, and reservation_status to describe the result.
Present these as available tickets at the returned price. A recommendation has
not reserved the seats; POST /v1/holds creates the reservation. When no group is
available, recommendations is empty. Never invent unlisted fallback suggestions.
Each listing is an inseparable delivery unit; price_cents is its TOTAL all-in USD
price. Do not multiply by seat count. Accessible spaces are opt-in. Show restrictions.
Entry-ticket delivery may be pending after a confirmed purchase; the order and
seat ownership are recorded immediately after verified payment. Delivery status
is separate from inventory availability and does not block checkout.

Purchase:
1. Show the buyer exact date/time, format, seats, restrictions and total.
2. POST /v1/holds with showtime_id, listing_ids, expected_total_cents, buyer.email,
   and a unique Idempotency-Key header. Include buyer.phone_number in E.164 format
   when known; a saved phone is reused when omitted. GET /v1/buyer returns saved
   contacts for this identity. Holds last 10 minutes. Reuse that key for exact retries.
3. POST /v1/orders/{id}/pay/mpp with {} for a Stripe MPP 402 challenge; submit the
   payment credential and fresh SIWX proof on the paid retry. A trusted server can
   instead use X-Internal-API-Key plus X-User-Id, the same as TicketWallet/CrowdVolt.
   Direct SPT clients read GET /v1/payment-requirements then POST /v1/orders/{id}/pay
   with shared_payment_token. Never request or send raw card details.
4. GET /v1/orders/{id} to retrieve status and private delivery URLs after payment.
   Keep the same verified buyer identity throughout. Never publish delivery URLs.
   The order stores buyer contact details and owns its exact seats after payment.
   The confirmation email is passed to Stripe for the payment receipt.
   GET /v1/orders/{id}/tickets with the same buyer credentials returns one private
   organizer check-in pass per seat. Each pass has a QR credential and ticket link.
   For chat, return confirmation_image_url once per order. Individual ticket url
   fields open HTML ticket pages, not PNGs. The merchant also emails the passes.
   Do not publish or log ticket credentials. These are not AMC barcodes.
   Paid orders include confirmation_image_url, a direct signed image link valid
   for seven days. Return this private link unchanged for display in chat.
   It contains one ticket panel per seat, each with its admission QR, seat map and
   local screening details. It has rounded corners, transparent edges and no buttons.
   Product image_url is the public official film poster; use it in product cards.
   Fetch order.png_url with the same buyer credentials and attach the returned PNG.
   This private order map shows the buyer's purchased seats in green and active
   selections in yellow. Other buyers' held or purchased seats show a red X.
5. POST /v1/orders/{id}/cancel with {} releases an unpaid hold.

Payment safety: Payment credentials are scoped to one immutable order and total.
After any ambiguous failure read the SAME order, preserve the SAME payment token,
and never mint a replacement automatically. Pending payment locks do not expire.
An operator must reconcile unresolved payments. Paid orders are never charged again.

Identity: SIGN-IN-WITH-X (AgentCash SIWX) or both trusted-server headers.
Each SIWX proof is single-use, including a request that returns a payment challenge.
Use a fresh proof on every retry. Never share the internal API key with an agent
or browser. Browsing, maps and recommendations are public and free.

Operator inventory import is protected at POST /internal/inventory/import.
Ready fulfillment consists of the entry ticket links configured for each listing.
Pending delivery includes no ticket URL until an entry ticket is attached.