Bump to 3.11.0

Currently translated at 100.0% (3756 of 3756 strings)

Translation: pretix/pretix
Translate-URL: https://translate.pretix.eu/projects/pretix/pretix/de_Informal/

powered by weblate

.github/workflows/docs.yml

@@ -0,0 +1,42 @@
+name: Documentation
+
+on:
+  push:
+    branches: [ master ]
+    paths-ignore:
+      - 'src/pretix/locale/**'
+      - 'src/pretix/static/**'
+      - 'src/tests/**'
+  pull_request:
+    branches: [ master ]
+    paths-ignore:
+      - 'src/pretix/locale/**'
+      - 'src/pretix/static/**'
+      - 'src/tests/**'
+
+jobs:
+  spelling:
+    name: Spellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install system packages
+        run: sudo apt update && sudo apt install enchant hunspell aspell-en
+      - name: Install Dependencies
+        run: pip3 install --no-use-pep517 -Ur doc/requirements.txt
+      - name: Spellcheck docs
+        run: make spelling
+        working-directory: ./doc
+      - name:
+        run: '[ ! -s _build/spelling/output.txt ]'
+        working-directory: ./doc

.github/workflows/strings.yml

@@ -0,0 +1,62 @@
+name: Strings
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'doc/**'
+      - 'src/pretix/locale/**'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'doc/**'
+      - 'src/pretix/locale/**'
+
+jobs:
+  compile:
+    runs-on: ubuntu-latest
+    name: Check gettext syntax
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install system packages
+        run: sudo apt update && sudo apt install gettext
+      - name: Install Dependencies
+        run: pip3 install --no-use-pep517 -Ur src/requirements.txt
+      - name: Compile messages
+        run: python manage.py compilemessages
+        working-directory: ./src
+      - name: Compile jsi18n
+        run: python manage.py compilejsi18n
+        working-directory: ./src
+  spelling:
+    runs-on: ubuntu-latest
+    name: Spellcheck
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install system packages
+        run: sudo apt update && sudo apt install enchant hunspell hunspell-de-de aspell-en aspell-de
+      - name: Install Dependencies
+        run: pip3 install --no-use-pep517 -Ur src/requirements/dev.txt
+      - name: Spellcheck translations
+        run: potypo
+        working-directory: ./src

.github/workflows/style.yml

@@ -0,0 +1,55 @@
+name: Code Style
+
+on:
+  push:
+    branches: [ master ]
+    paths-ignore:
+      - 'src/pretix/locale/**'
+      - 'src/pretix/static/**'
+  pull_request:
+    branches: [ master ]
+    paths-ignore:
+      - 'src/pretix/locale/**'
+      - 'src/pretix/static/**'
+
+jobs:
+  isort:
+    name: isort
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install Dependencies
+        run: pip3 install --no-use-pep517 -Ur src/requirements/dev.txt
+      - name: Run isort
+        run: isort -c .
+        working-directory: ./src
+  flake:
+    name: flake8
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install Dependencies
+        run: pip3 install -r src/requirements.txt --no-use-pep517 -Ur src/requirements/dev.txt
+      - name: Run flake8
+        run: flake8 .
+        working-directory: ./src

.github/workflows/tests.yml

@@ -0,0 +1,75 @@
+name: Tests
+
+on:
+  push:
+    branches: [ master ]
+    paths-ignore:
+      - 'doc/**'
+      - 'src/pretix/locale/**'
+  pull_request:
+    branches: [ master ]
+    paths-ignore:
+      - 'doc/**'
+      - 'src/pretix/locale/**'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    name: Tests
+    strategy:
+      matrix:
+        python-version: [3.6, 3.7, 3.8]
+        database: [sqlite, postgres, mysql]
+        exclude:
+          - database: mysql
+            python-version: 3.7
+          - database: sqlite
+            python-version: 3.7
+          - database: mysql
+            python-version: 3.6
+          - database: sqlite
+            python-version: 3.6
+    steps:
+      - uses: actions/checkout@v2
+      - uses: getong/mariadb-action@v1.1
+        with:
+          mariadb version: '10.4'
+          mysql database: 'pretix'
+          mysql root password: ''
+        if: matrix.database == 'mysql'
+      - uses: harmon758/postgresql-action@v1
+        with:
+          postgresql version: '11'
+          postgresql db: 'pretix'
+          postgresql user: 'postgres'
+          postgresql password: 'postgres'
+        if: matrix.database == 'postgres'
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v1
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: actions/cache@v1
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+      - name: Install system dependencies
+        run: sudo apt update && sudo apt install gettext mysql-client
+      - name: Install Python dependencies
+        run: pip3 install -r src/requirements.txt --no-use-pep517 -Ur src/requirements/dev.txt mysqlclient psycopg2-binary
+      - name: Run checks
+        run: python manage.py check
+        working-directory: ./src
+      - name: Compile
+        working-directory: ./src
+        run: make all compress
+      - name: Run tests
+        working-directory: ./src
+        run: PRETIX_CONFIG_FILE=tests/travis_${{ matrix.database }}.cfg py.test -n 3 -p no:sugar --cov=./ --cov-report=xml --reruns 3 tests --maxfail=100
+      - name: Upload coverage
+        uses: codecov/codecov-action@v1
+        with:
+          file: src/coverage.xml
+          fail_ci_if_error: true
+        if: matrix.database == 'postgres' && matrix.python-version == '3.8'

.gitlab-ci.yml

@@ -5,7 +5,11 @@ tests:
         - virtualenv env
         - source env/bin/activate
         - pip install -U pip wheel setuptools
-        - XDG_CACHE_HOME=/cache bash .travis.sh tests
+        - XDG_CACHE_HOME=/cache pip3 install -r src/requirements.txt --no-use-pep517 -Ur src/requirements/dev.txt
+        - cd src
+        - python manage.py check
+        - make all compress
+        - py.test --reruns 3 -n 3 tests
     tags:
         - python3
     except:
@@ -16,15 +20,17 @@ pypi:
         - cp /keys/.pypirc ~/.pypirc
         - virtualenv env
         - source env/bin/activate
-        - pip install -U pip wheel setuptools
+        - pip install -U pip wheel setuptools check-manifest twine
         - XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
         - cd src
         - python setup.py sdist
         - pip install dist/pretix-*.tar.gz
         - python -m pretix migrate
         - python -m pretix check
-        - python setup.py sdist upload
-        - python setup.py bdist_wheel upload
+        - check-manifest
+        - python setup.py sdist bdist_wheel
+        - twine check dist/*
+        - twine upload dist/*
     tags:
         - python3
     only:

.travis.sh

@@ -1,68 +0,0 @@
-#!/bin/bash
-set -e
-set -x
-
-echo "Executing job $1"
-
-if [ "$PRETIX_CONFIG_FILE" == "tests/travis_mysql.cfg" ]; then
-    mysql -u root -e 'CREATE DATABASE pretix DEFAULT CHARACTER SET utf8 DEFAULT COLLATE utf8_general_ci;'
-    pip3 install -Ur src/requirements/mysql.txt
-fi
-
-if [ "$PRETIX_CONFIG_FILE" == "tests/travis_postgres.cfg" ]; then
-    psql -c 'create database travis_ci_test;' -U postgres
-fi
-
-if [ "$1" == "style" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements.txt -r src/requirements/dev.txt
-	cd src
-    flake8 .
-    isort -c -rc -df .
-fi
-if [ "$1" == "doctests" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
-	cd doc
-	make doctest
-fi
-if [ "$1" == "doc-spelling" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur doc/requirements.txt
-	cd doc
-	make spelling
-	if [ -s _build/spelling/output.txt ]; then
-		exit 1
-	fi
-fi
-if [ "$1" == "translation-spelling" ]; then
-	XDG_CACHE_HOME=/cache pip3 install -Ur src/requirements/dev.txt
-	cd src
-	potypo
-fi
-if [ "$1" == "tests" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
-	cd src
-	python manage.py check
-	make all compress
-	py.test --reruns 5 -n 3 tests
-fi
-if [ "$1" == "tests-cov" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
-	cd src
-	python manage.py check
-	make all compress
-	coverage run -m py.test --reruns 5 tests && codecov
-fi
-if [ "$1" == "plugins" ]; then
-	pip3 install -r src/requirements.txt -Ur src/requirements/dev.txt
-	cd src
-	python setup.py develop
-	make all compress
-
-	pushd ~
-    git clone --depth 1 https://github.com/pretix/pretix-cartshare.git
-    cd pretix-cartshare
-    python setup.py develop
-    make
-	py.test --reruns 5 tests
-    popd
-
-fi

.travis.yml

@@ -1,47 +0,0 @@
-language: python
-dist: xenial
-sudo: false
-install:
-  - pip install -U pip wheel setuptools
-script:
-  - bash .travis.sh $JOB
-cache:
-  directories:
-    - $HOME/.cache/pip
-services:
-  - mysql
-  - postgresql
-matrix:
-  include:
-    - python: 3.7
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_sqlite.cfg
-    - python: 3.7
-      env: JOB=tests-cov PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.7
-      env: JOB=style
-    - python: 3.7
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_mysql.cfg
-    - python: 3.7
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.5
-      env: JOB=tests PRETIX_CONFIG_FILE=tests/travis_postgres.cfg
-    - python: 3.7
-      env: JOB=plugins
-    - python: 3.7
-      env: JOB=doc-spelling
-    - python: 3.7
-      env: JOB=translation-spelling
-addons:
-  postgresql: "9.4"
-  mariadb: '10.3'
-  apt:
-      packages:
-          - enchant
-          - myspell-de-de
-          - aspell-en
-          - sqlite3
-  sources:
-    - travis-ci/sqlite3
-branches:
-  except:
-  - /^weblate-.*/

CONTRIBUTING.md

@@ -3,7 +3,7 @@ Contributing to pretix
 
 Hey there and welcome to pretix!
 
-We've got an contributors guide in [our documentation](https://docs.pretix.eu/en/latest/development/contribution/)
+We've got a contributors guide in [our documentation](https://docs.pretix.eu/en/latest/development/contribution/)
 together with notes on the [development setup](https://docs.pretix.eu/en/latest/development/setup.html).
 
 Please note that we have a [Code of Conduct](https://docs.pretix.eu/en/latest/development/contribution/codeofconduct.html)

Dockerfile

@@ -29,7 +29,7 @@ RUN apt-get update && \
     mkdir /etc/pretix && \
     mkdir /data && \
     useradd -ms /bin/bash -d /pretix -u 15371 pretixuser && \
-    echo 'pretixuser ALL=(ALL) NOPASSWD: /usr/bin/supervisord' >> /etc/sudoers && \
+    echo 'pretixuser ALL=(ALL) NOPASSWD:SETENV: /usr/bin/supervisord' >> /etc/sudoers && \
     mkdir /static
 
 ENV LC_ALL=C.UTF-8 \
@@ -57,6 +57,8 @@ COPY deployment/docker/nginx.conf /etc/nginx/nginx.conf
 COPY deployment/docker/production_settings.py /pretix/src/production_settings.py
 COPY src /pretix/src
 
+RUN cd /pretix/src && pip3 install .
+
 RUN chmod +x /usr/local/bin/pretix && \
     rm /etc/nginx/sites-enabled/default && \
     cd /pretix/src && \

README.rst

@@ -4,11 +4,10 @@ pretix
 .. image:: https://img.shields.io/pypi/v/pretix.svg
    :target: https://pypi.python.org/pypi/pretix
 
-.. image:: https://readthedocs.org/projects/pretix/badge/?version=latest
+.. image:: https://github.com/pretix/pretix/workflows/Documentation/badge.svg
    :target: https://docs.pretix.eu/en/latest/
 
-.. image:: https://travis-ci.org/pretix/pretix.svg?branch=master
-   :target: https://travis-ci.org/pretix/pretix
+.. image:: https://github.com/pretix/pretix/workflows/Tests/badge.svg
 
 .. image:: https://codecov.io/gh/pretix/pretix/branch/master/graph/badge.svg
    :target: https://codecov.io/gh/pretix/pretix
@@ -20,9 +19,8 @@ Reinventing ticket presales, one ticket at a time.
 Project status & release cycle
 ------------------------------
 
-While there is always a lot to do and improve on, pretix by now has been in use for more than a dozen
-conferences that sold over ten thousand tickets combined without major problems. We therefore think of
-pretix as being stable and ready to use.
+While there is always a lot to do and improve on, pretix by now has been in use for thousands of events
+conferences that sold millions of tickets combined. We therefore think of pretix as being stable and ready to use.
 
 If you want to use or extend pretix, we strongly recommend to follow our `blog`_. We will announce all
 releases there. You can always find the latest stable version on PyPI or in the ``release/X.Y`` branch of
@@ -31,9 +29,13 @@ the sense that it does not break your data,  but its APIs might change without p
 
 To get started using pretix on your own server, look at the `installation guide`_ in our documentation.
 
-This project is 100 percent free and open source software. If you are interested in commercial support,
-hosting services or supporting this project financially, please go to `pretix.eu`_ or contact us at
-support@pretix.eu.
+Support
+-------
+
+This project is 100 percent free and open source software. You are welcome to ask questions in the GitHub
+repository. Private support via email or phone is only offered to customers of our pretix Hosted or pretix
+Enterprise offerings. If you are interested in commercial support, hosting services or supporting this project
+financially, please go to `pretix.eu`_ or contact us at support@pretix.eu.
 
 Contributing
 ------------
@@ -53,8 +55,8 @@ License
 The code in this repository is published under the terms of the Apache License. 
 See the LICENSE file for the complete license text.
 
-This project is maintained by Raphael Michel <mail@raphaelmichel.de>. See the
-AUTHORS file for a list of all the awesome folks who contributed to this project.
+This project is maintained by Raphael Michel. See the AUTHORS file for a list of all
+the awesome folks who contributed to this project.
 
 .. _installation guide: https://docs.pretix.eu/en/latest/admin/installation/index.html
 .. _developer documentation: https://docs.pretix.eu/en/latest/development/index.html

deployment/docker/nginx.conf

@@ -4,7 +4,7 @@ pid /var/run/nginx.pid;
 daemon off;
 
 events {
-	worker_connections 768;
+	worker_connections 4096;
 }
 
 http {
@@ -39,7 +39,7 @@ http {
 	include /etc/nginx/conf.d/*.conf;
 
     server {
-        listen 80 default_server;
+        listen 80 backlog=4096 default_server;
         listen [::]:80 ipv6only=on default_server;
         server_name _;
         index index.php index.html;

deployment/docker/pretix.bash

@@ -19,7 +19,7 @@ fi
 python3 -m pretix migrate --noinput
 
 if [ "$1" == "all" ]; then
-    exec sudo /usr/bin/supervisord -n -c /etc/supervisord.conf
+    exec sudo -E /usr/bin/supervisord -n -c /etc/supervisord.conf
 fi
 
 if [ "$1" == "webworker" ]; then

doc/admin/config.rst

@@ -57,6 +57,9 @@ Example::
     A comma-separated list of plugins that are not available even though they are installed.
     Defaults to an empty string.
 
+``auth_backends``
+    A comma-separated list of available auth backends. Defaults to ``pretix.base.auth.NativeAuthBackend``.
+
 ``cookie_domain``
     The cookie domain to be set. Defaults to ``None``.
 
@@ -78,6 +81,22 @@ Example::
     Enables or disables nagging staff users for leaving comments on their sessions for auditability.
     Defaults to ``off``.
 
+``obligatory_2fa``
+    Enables or disables obligatory usage of Two-Factor Authentication for users of the pretix backend.
+    Defaults to ``False``
+
+``trust_x_forwarded_for``
+    Specifies whether the ``X-Forwarded-For`` header can be trusted. Only set to ``on`` if you have a reverse
+    proxy that actively removes and re-adds the header to make sure the correct client IP is the first value.
+    Defaults to ``off``.
+
+``trust_x_forwarded_proto``
+    Specifies whether the ``X-Forwarded-Proto`` header can be trusted. Only set to ``on`` if you have a reverse
+    proxy that actively removes and re-adds the header to make sure the correct value is set.
+    Defaults to ``off``.
+
+``csp_log``
+    Log violations of the Content Security Policy (CSP). Defaults to ``on``.
 
 Locale settings
 ---------------
@@ -125,6 +144,8 @@ Example::
     Indicates if the database backend is a MySQL/MariaDB Galera cluster and
     turns on some optimizations/special case handlers. Default: ``False``
 
+.. _`config-replica`:
+
 Database replica settings
 -------------------------
 
@@ -142,6 +163,8 @@ Example::
     [replica]
     host=192.168.0.2
 
+.. _`config-urls`:
+
 URLs
 ----
 
@@ -269,6 +292,24 @@ to speed up various operations::
 If redis is not configured, pretix will store sessions and locks in the database. If memcached
 is configured, memcached will be used for caching instead of redis.
 
+Translations
+------------
+
+pretix comes with a number of translations. Some of them are marked as "incubating", which means
+they can usually only be selected in development mode. If you want to use them nevertheless, you
+can activate them like this::
+
+    [languages]
+    allow_incubating=pt-br,da
+
+You can also tell pretix about additional paths where it will search for translations::
+
+    [languages]
+    path=/path/to/my/translations
+
+For a given language (e.g. ``pt-br``), pretix will then look in the
+specific sub-folder, e.g. ``/path/to/my/translations/pt_BR/LC_MESSAGES/django.po``.
+
 Celery task queue
 -----------------
 
@@ -298,6 +339,15 @@ application. If you want to use sentry, you need to set a DSN in the configurati
     You will be given this value by your sentry installation.
 
 
+Caching
+-------
+
+You can adjust some caching settings to control how much storage pretix uses::
+
+    [cache]
+    tickets=48  ; Number of hours tickets (PDF, passbook, …) are cached
+
+
 Secret length
 -------------
 

doc/admin/index.rst

@@ -11,3 +11,5 @@ This documentation is for everyone who wants to install pretix on a server.
    installation/index
    config
    maintainance
+   scaling
+   indexes

doc/admin/indexes.rst

@@ -0,0 +1,73 @@
+Additional database indices
+===========================
+
+If you have a large pretix database, some features such as search for orders or events might turn pretty slow.
+For PostgreSQL, we have compiled a list of additional database indexes that you can add to speed things up.
+Just like any index, they in turn make write operations insignificantly slower and cause the database to use
+more disk space.
+
+The indexes aren't automatically created by pretix since Django does not allow us to do so only on PostgreSQL
+(and they won't work on other databases). Also, they're really not necessary if you're not having tens of
+thousands of records in your database.
+
+However, this also means they won't automatically adapt if some of the referred fields change in future updates of pretix
+and you might need to re-check this page and change them manually.
+
+Here is the currently recommended set of commands::
+
+    CREATE EXTENSION pg_trgm;
+
+    CREATE INDEX CONCURRENTLY pretix_addidx_event_slug
+        ON pretixbase_event
+        USING gin (upper("slug") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_event_name
+        ON pretixbase_event
+        USING gin (upper("name") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_order_code
+        ON pretixbase_order
+        USING gin (upper("code") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_voucher_code
+        ON pretixbase_voucher
+        USING gin (upper("code") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_invoice_nu1
+        ON "pretixbase_invoice" (UPPER("invoice_no"));
+    CREATE INDEX CONCURRENTLY pretix_addidx_invoice_nu2
+        ON "pretixbase_invoice" (UPPER("full_invoice_no"));
+    CREATE INDEX CONCURRENTLY pretix_addidx_organizer_name
+        ON pretixbase_organizer
+        USING gin (upper("name") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_organizer_slug
+        ON pretixbase_organizer
+        USING gin (upper("slug") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_order_email
+        ON pretixbase_order
+        USING gin (upper("email") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_order_comment
+        ON pretixbase_order
+        USING gin (upper("comment") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_orderpos_name
+        ON pretixbase_orderposition
+        USING gin (upper("attendee_name_cached") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_orderpos_scret
+        ON pretixbase_orderposition
+        USING gin (upper("secret") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_orderpos_email
+        ON pretixbase_orderposition
+        USING gin (upper("attendee_email") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_ia_name
+        ON pretixbase_invoiceaddress
+        USING gin (upper("name_cached") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_ia_company
+        ON pretixbase_invoiceaddress
+        USING gin (upper("company") gin_trgm_ops);
+
+
+Also, if you use our ``pretix-shipping`` plugin::
+
+    CREATE INDEX CONCURRENTLY pretix_addidx_sa_name
+        ON pretix_shipping_shippingaddress
+        USING gin (upper("name") gin_trgm_ops);
+    CREATE INDEX CONCURRENTLY pretix_addidx_sa_company
+        ON pretix_shipping_shippingaddress
+        USING gin (upper("company") gin_trgm_ops);
+

doc/admin/installation/docker_smallscale.rst

@@ -26,7 +26,7 @@ installation guides):
 * `Docker`_
 * A SMTP server to send out mails, e.g. `Postfix`_ on your machine or some third-party server you have credentials for
 * A HTTP reverse proxy, e.g. `nginx`_ or Apache to allow HTTPS connections
-* A `PostgreSQL`_, `MySQL`_ 5.7+, or MariaDB 10.2.7+ database server
+* A `PostgreSQL`_ 9.5+, `MySQL`_ 5.7+, or MariaDB 10.2.7+ database server
 * A `redis`_ server
 
 We also recommend that you use a firewall, although this is not a pretix-specific recommendation. If you're new to
@@ -125,6 +125,8 @@ Fill the configuration file ``/etc/pretix/pretix.cfg`` with the following conten
     ; DO NOT change the following value, it has to be set to the location of the
     ; directory *inside* the docker container
     datadir=/data
+    trust_x_forwarded_for=on
+    trust_x_forwarded_proto=on
 
     [database]
     ; Replace postgresql with mysql for MySQL
@@ -180,6 +182,7 @@ named ``/etc/systemd/system/pretix.service`` with the following content::
         -v /var/pretix-data:/data \
         -v /etc/pretix:/etc/pretix \
         -v /var/run/redis:/var/run/redis \
+        --sysctl net.core.somaxconn=4096 \
         pretix/standalone:stable all
     ExecStop=/usr/bin/docker stop %n
 
@@ -276,7 +279,7 @@ choice)::
 
 Then, go to that directory and build the image::
 
-    $ docker build -t mypretix
+    $ docker build . -t mypretix
 
 You can now use that image ``mypretix`` instead of ``pretix/standalone`` in your service file (see above). Be sure
 to re-build your custom image after you pulled ``pretix/standalone`` if you want to perform an update.
@@ -287,7 +290,7 @@ to re-build your custom image after you pulled ``pretix/standalone`` if you want
 .. _Let's Encrypt: https://letsencrypt.org/
 .. _pretix.eu: https://pretix.eu/
 .. _MySQL: https://dev.mysql.com/doc/refman/5.7/en/linux-installation-apt-repo.html
-.. _PostgreSQL: https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-9-4-on-debian-8
+.. _PostgreSQL: https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-on-ubuntu-20-04
 .. _redis: https://blog.programster.org/debian-8-install-redis-server/
 .. _ufw: https://en.wikipedia.org/wiki/Uncomplicated_Firewall
 .. _redis website: https://redis.io/topics/security

doc/admin/installation/enterprise.rst

@@ -68,7 +68,7 @@ generated key and installs the plugin from the URL we told you::
         mkdir -p /etc/ssh && \
         ssh-keyscan -t rsa -p 10022 code.rami.io >> /root/.ssh/known_hosts && \
         echo StrictHostKeyChecking=no >> /root/.ssh/config && \
-        pip3 install -Ue "git+ssh://git@code.rami.io:10022/pretix/pretix-slack.git@stable#egg=pretix-slack" && \
+        DJANGO_SETTINGS_MODULE=pretix.settings pip3 install -U "git+ssh://git@code.rami.io:10022/pretix/pretix-slack.git@stable#egg=pretix-slack" && \
         cd /pretix/src && \
         sudo -u pretixuser make production
     USER pretixuser

doc/admin/installation/index.rst

@@ -1,3 +1,5 @@
+.. _`installation`:
+
 Installation guide
 ==================
 

doc/admin/installation/manual_smallscale.rst

@@ -12,7 +12,7 @@ solution with many things readily set-up, look at :ref:`dockersmallscale`.
              get it right. If you're not feeling comfortable managing a Linux server, check out our hosting and service
              offers at `pretix.eu`_.
 
-We tested this guide on the Linux distribution **Debian 8.0** but it should work very similar on other
+We tested this guide on the Linux distribution **Debian 10.0** but it should work very similar on other
 modern distributions, especially on all systemd-based ones.
 
 Requirements
@@ -23,7 +23,7 @@ installation guides):
 
 * A SMTP server to send out mails, e.g. `Postfix`_ on your machine or some third-party server you have credentials for
 * A HTTP reverse proxy, e.g. `nginx`_ or Apache to allow HTTPS connections
-* A `PostgreSQL`_, `MySQL`_ 5.7+, or MariaDB 10.2.7+ database server
+* A `PostgreSQL`_ 9.5+, `MySQL`_ 5.7+, or MariaDB 10.2.7+ database server
 * A `redis`_ server
 
 We also recommend that you use a firewall, although this is not a pretix-specific recommendation. If you're new to
@@ -85,6 +85,8 @@ Fill the configuration file ``/etc/pretix/pretix.cfg`` with the following conten
     url=https://pretix.mydomain.com
     currency=EUR
     datadir=/var/pretix/data
+    trust_x_forwarded_for=on
+    trust_x_forwarded_proto=on
 
     [database]
     ; For MySQL, replace with "mysql"
@@ -131,7 +133,7 @@ command if you're running MySQL::
 
     (venv)$ pip3 install "pretix[postgres]" gunicorn
 
-Note that you need Python 3.5 or newer. You can find out your Python version using ``python -V``.
+Note that you need Python 3.6 or newer. You can find out your Python version using ``python -V``.
 
 We also need to create a data directory::
 
@@ -306,7 +308,7 @@ example::
 .. _Let's Encrypt: https://letsencrypt.org/
 .. _pretix.eu: https://pretix.eu/
 .. _MySQL: https://dev.mysql.com/doc/refman/5.7/en/linux-installation-apt-repo.html
-.. _PostgreSQL: https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-9-4-on-debian-8
+.. _PostgreSQL: https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-on-ubuntu-20-04
 .. _redis: https://blog.programster.org/debian-8-install-redis-server/
 .. _ufw: https://en.wikipedia.org/wiki/Uncomplicated_Firewall
 .. _strong encryption settings: https://mozilla.github.io/server-side-tls/ssl-config-generator/

doc/admin/maintainance.rst

@@ -92,7 +92,8 @@ pretix_task_duration_seconds
 
 pretix_model_instances
     Gauge. Measures number of instances of a certain model within the database, labeled with
-    the ``model`` name.
+    the ``model`` name. Starting with pretix 3.11, these numbers might only be approximate for
+    most tables when running on PostgreSQL to mitigate performance impact.
 
 .. _metric types: https://prometheus.io/docs/concepts/metric_types/
 .. _Prometheus: https://prometheus.io/

doc/admin/scaling.rst

@@ -0,0 +1,236 @@
+.. _`scaling`:
+
+Scaling guide
+=============
+
+Our :ref:`installation guide <installation>` only covers "small-scale" setups, by which we mostly mean
+setups that run on a **single (virtual) machine** and do not encounter large traffic peaks.
+
+We do not offer an installation guide for larger-scale setups of pretix, mostly because we believe that
+there is no one-size-fits-all solution for this and the desired setup highly depends on your use case,
+the platform you run pretix on, and your technical capabilities. We do not recommend trying set up pretix
+in a multi-server environment if you do not already have experience with managing server clusters.
+
+This document is intended to give you a general idea on what issues you will encounter when you scale up
+and what you should think of.
+
+.. tip::
+
+   If you require more help on this, we're happy to help. Our pretix Enterprise support team has built
+   and helped building, scaling and load-testing pretix installations at any scale and we're looking
+   forward to work with you on fine-tuning your system. If you intend to sell **more than a thousand
+   tickets in a very short amount of time**, we highly recommend reaching out and at least talking this
+   through. Just get in touch at sales@pretix.eu!
+
+Scaling reasons
+---------------
+
+There's mainly two reasons to scale up a pretix installation beyond a single server:
+
+* **Availability:** Distributing pretix over multiple servers can allow you to survive failure of one or more single machines, leading to a higher uptime and reliability of your system.
+
+* **Traffic and throughput:** Distributing pretix over multiple servers can allow you to process more web requests and ticket sales at the same time.
+
+You are very unlikely to require scaling for other reasons, such as having too much data in your database.
+
+Components
+----------
+
+A pretix installation usually consists of the following components which run performance-relevant processes:
+
+* ``pretix-web`` is the Django-based web application that serves all user interaction.
+
+* ``pretix-worker`` is a Celery-based application that processes tasks that should be run asynchronously outside of the web application process.
+
+* A **SQL database** keeps all the important data and processes the actual transactions. We recommend using PostgreSQL, but MySQL/MariaDB works as well.
+
+* A **web server** that terminates TLS and HTTP connections and forwards them to ``pretix-web``. In some cases, e.g. when serving static files, the web servers might return a response directly. We recommend using ``nginx``.
+
+* A **redis** server responsible for the communication between ``pretix-web`` and ``pretix-worker``, as well as for caching.
+
+* A directory of **media files** such as user-uploaded files or generated files (tickets, invoices, …) that are created and used by ``pretix-web``, ``pretix-worker`` and the web server.
+
+In the following, we will discuss the scaling behavior of every component individually. In general, you can run all of the components
+on the same server, but you can just as well distribute every component to its own server, or even use multiple servers for some single
+components.
+
+.. warning::
+
+   When setting up your system, don't forget about security. In a multi-server environment,
+   you need to take special care to ensure that no unauthorized access to your database
+   is possible through the network and that it's not easy to wiretap your connections. We
+   recommend a rigorous use of firewalls and encryption on all communications. You can
+   ensure this either on an application level (such as using the TLS support in your
+   database) or on a network level with a VPN solution.
+
+Web server
+""""""""""
+
+Your web server is at the very front of your installation. It will need to absorb all of the traffic, and it should be able to
+at least show a decent error message, even when everything else fails. Luckily, web servers are really fast these days, so this
+can be achieved without too much work.
+
+We recommend reading up on tuning your web server for high concurrency. For nginx, this means thinking about the number of worker
+processes and the number of connections each worker process accepts. Double-check that TLS session caching works, because TLS
+handshakes can get really expensive.
+
+During a traffic peak, your web server will be able to make us of more CPU resources, while memory usage will stay comparatively low,
+so if you invest in more hardware here, invest in more and faster CPU cores.
+
+Make sure that pretix' static files (such as CSS and JavaScript assets) as well as user-uploaded media files (event logos, etc)
+are served directly by your web server and your web server caches them in-memory (nginx does it by default) and sets useful
+headers for client-side caching. As an additional performance improvement, you can turn of access logging for these types of files.
+If you want, you can even farm out serving static files to a different web server entirely and :ref:`configure pretix to reference
+them from a different URL <config-urls>`.
+
+.. tip::
+
+   If you expect *really high traffic* for your very popular event, you might want to do some rate limiting on this layer, or,
+   if you want to ensure a fair and robust first-come-first-served experience and prefer letting users wait over showing them
+   errors, consider a queuing solution. We're happy to provide you with such systems, just get in touch at sales@pretix.eu.
+
+pretix-web
+""""""""""
+
+The ``pretix-web`` process does not carry any internal state can be easily started on as many machines as you like, and you can
+use the load balancing features of your frontend web server to redirect to all of them.
+
+You can adjust the number of processes in the ``gunicorn`` command line, and we recommend choosing roughly two times the number
+of CPU cores available. Under load, the memory consumption of ``pretix-web`` will stay comparatively constant, while the CPU usage
+will increase a lot. Therefore, if you can add more or faster CPU cores, you will be able to serve more users.
+
+pretix-worker
+"""""""""""""
+
+The ``pretix-worker`` process performs all operations that are not directly executed in the request-response-cycle of ``pretix-web``.
+Just like ``pretix-web`` you can easily start up as many instances as you want on different machines to share the work. As long as they
+all talk to the same redis server, they will all receive tasks from ``pretix-web``, work on them and post their result back.
+You can configure the number of threads that run tasks in parallel through the ``--concurrency`` command line option of ``celery``.
+
+Just like ``pretix-web``, this process is mostly heavy on CPU, disk IO and network IO, although memory peaks can occur e.g. during the
+generation of large PDF files, so we recommend having some reserves here.
+
+``pretix-worker`` performs a variety of tasks which are of different importance.
+Some of them are mission-critical and need to be run quickly even during high load (such as
+creating a cart or an order), others are irrelevant and can easily run later (such as
+distributing tickets on the waiting list). You can fine-tune the capacity you assign to each
+of these tasks by running ``pretix-worker`` processes that only work on a specific **queue**.
+For example, you could have three servers dedicated only to process order creations and one
+server dedicated only to sending emails. This allows you to set priorities and also protects
+you from e.g. a slow email server lowering your ticket throughput.
+
+You can do so by specifying one or more queues on the ``celery`` command line of this process, such as ``celery -A pretix.celery_app worker -Q notifications,mail``. Currently,
+the following queues exist:
+
+* ``checkout`` -- This queue handles everything related to carts and orders and thereby everything required to process a sale. This includes adding and deleting items from carts as well as creating and canceling orders.
+
+* ``mail`` -- This queue handles sending of outgoing emails.
+
+* ``notifications`` -- This queue handles the processing of any outgoing notifications, such as email notifications to admin users (except for the actual sending) or API notifications to registered webhooks.
+
+* ``background`` -- This queue handles tasks that are expected to take long or have no human waiting for their result immediately, such as refreshing caches, re-generating CSS files, assigning tickets on the waiting list or parsing bank data files.
+
+* ``default`` -- This queue handles everything else with "medium" or unassigned priority, most prominently the generation of files for tickets, invoices, badges, admin exports, etc.
+
+Media files
+"""""""""""
+
+Both ``pretix-web``, ``pretix-worker`` and in some cases your webserver need to work with
+media files. Media files are all files generated *at runtime* by the software. This can
+include files uploaded by the event organizers, such as the event logo, files uploaded by
+ticket buyers (if you use such features) or files generated by the software, such as
+ticket files, invoice PDFs, data exports or customized CSS files.
+
+Those files are by default stored to the ``media/`` sub-folder of the data directory given
+in the ``pretix.cfg`` configuration file. Inside that ``media/`` folder, you will find a
+``pub/`` folder containing the subset of files that should be publicly accessible through
+the web server. Everything else only needs to be accessible by ``pretix-web`` and
+``pretix-worker`` themselves.
+
+If you distribute ``pretix-web`` or ``pretix-worker`` across more than one machine, you
+**must** make sure that they all have access to a shared storage to read and write these
+files, otherwise you **will** run into errors with the user interface.
+
+The easiest solution for this is probably to store them on a NFS server that you mount
+on each of the other servers.
+
+Since we use Django's file storage mechanism internally, you can in theory also use a object-storage solution like Amazon S3, Ceph, or Minio to store these files, although we currently do not expose this through pretix' configuration file and this would require you to ship your own variant of ``pretix/settings.py`` and reference it through the ``DJANGO_SETTINGS_MODULE`` environment variable.
+
+At pretix.eu, we use a custom-built `object storage cluster`_.
+
+SQL database
+""""""""""""
+
+One of the most critical parts of the whole setup is the SQL database -- and certainly the
+hardest to scale. Tuning relational databases is an art form, and while there's lots of
+material on it on the internet, there's not a single recipe that you can apply to every case.
+
+As a general rule of thumb, the more resources you can give your databases, the better.
+Most databases will happily use all CPU cores available, but only use memory up to an amount
+you configure, so make sure to set this memory usage as high as you can afford. Having more
+memory available allows your database to make more use of caching, which is usually good.
+
+Scaling your database to multiple machines needs to be treated with great caution. It's a
+good to have a replica of your database for availability reasons. In case your primary
+database server fails, you can easily switch over to the replica and continue working.
+
+However, using database replicas for performance gains is much more complicated. When using
+replicated database systems, you are always trading in consistency or availability to get
+additional performance and the consequences of this can be subtle and it is important
+that you have a deep understanding of the semantics of your replication mechanism.
+
+.. warning::
+
+   Using an off-the-shelf database proxy solution that redirects read queries to your
+   replicas and write queries to your primary database **will lead to very nasty bugs.**
+
+   As an example, if you buy a ticket, pretix first needs to calculate how many tickets
+   are left to sell. If this calculation is done on a database replica that lags behind
+   even for fractions of a second, the decision to allow selling the ticket will be made
+   on out-of-data data and you can end up with more tickets sold than configured. Similarly,
+   you could imagine situations leading to double payments etc.
+
+If you do have a replica, you *can* tell pretix about it :ref:`in your configuration <config-replica>`.
+This way, pretix can offload complex read-only queries to the replica when it is safe to do so.
+As of pretix 2.7, this is mainly used for search queries in the backend and for rendering the
+product list and event lists in the frontend, but we plan on expanding this in the future.
+
+Therefore, for now our clear recommendation is: Try to scale your database vertically and put
+it on the most powerful machine you have available.
+
+redis
+"""""
+
+While redis is a very important part that glues together some of the components, it isn't used
+heavily and can usually handle a fairly large pretix installation easily on a single modern
+CPU core.
+Having some memory available is good in case of e.g. lots of tasks queuing up during a traffic peak, but we wouldn't expect ever needing more than a gigabyte of it.
+
+Feel free to set up a redis cluster for availability – but you won't need it for performance in a long time.
+
+The limitations
+---------------
+
+Up to a certain point, pretix scales really well. However, there are a few things that we consider
+even more important than scalability, and those are correctness and reliability. We want you to be
+able to trust that pretix will not sell more tickets than you intended or run into similar error
+cases.
+
+Combined with pretix' flexibility and complexity, especially around vouchers and quotas, this creates
+some hard issues. In many cases, we need to fall back to event-global locking for some actions which
+are likely to run with high concurrency and cause harm.
+
+For every event, only one of these locking actions can be run at the same time. Examples for this are
+adding products limited by a quota to a cart, adding items to a cart using a voucher or placing an order
+consisting of cart positions that don't have a valid reservation for much longer. In these cases, it is
+currently not realistically possible to exceed selling **approx. 500 orders per minute per event**, even
+if you add more hardware.
+If you have an unlimited number of tickets, we can apply fewer locking and we've reached **approx.
+1500 orders per minute per event** in benchmarks, although even more should be possible.
+
+We're working to reduce the number of cases in which this is relevant and thereby improve the possible
+throughput. If you want to use pretix for an event with 10,000+ tickets that are likely to be sold out
+within minutes, please get in touch to discuss possible solutions. We'll work something out for you!
+
+
+.. _object storage cluster: https://behind.pretix.eu/2018/03/20/high-available-cdn/

doc/api/fundamentals.rst

@@ -170,6 +170,19 @@ Date                  String in ISO 8601 format    ``2017-12-27``
 Multi-lingual string  Object of strings            ``{"en": "red", "de": "rot", "de_Informal": "rot"}``
 Money                 String with decimal number   ``"23.42"``
 Currency              String with ISO 4217 code    ``"EUR"``, ``"USD"``
+Relative datetime     *either* String in ISO 8601  ``"2017-12-27T10:00:00.596934Z"``,
+                      format *or* specification of ``"RELDATE/3/12:00:00/presale_start/"``
+                      a relative datetime,
+                      constructed from a number of
+                      days before the base point,
+                      a time of day, and the base
+                      point.
+Relative date         *either* String in ISO 8601  ``"2017-12-27"``,
+                      format *or* specification of ``"RELDATE/3/-/presale_start/"``
+                      a relative date,
+                      constructed from a number of
+                      days before the base point
+                      and the base point.
 ===================== ============================ ===================================
 
 Query parameters

doc/api/guides/custom_checkout.rst

@@ -0,0 +1,132 @@
+Creating an external checkout process
+=====================================
+
+Occasionally, we get asked whether it is possible to just use pretix' powerful backend as a ticketing engine but use
+a fully-customized checkout process that only communicates via the API. This is possible, but with a few limitations.
+If you go down this route, you will miss out on many of pretix features and safeguards, as well as the added flexibility
+by most of pretix' plugins. We strongly recommend to talk this through with us before you decide this is the way to go.
+
+However, this is really useful if you need to tightly integrate pretix into existing web applications that e.g. control
+the pricing of your products in a way that cannot be mapped to pretix' product structures.
+
+Creating orders
+---------------
+
+After letting your user select the products to  buy in your application, you should create a new order object inside
+pretix. Below, you can see an example of such an order, but most fields are optional and there are some more features
+supported. Read :ref:`rest-orders-create` to learn more about this endpoint.
+
+Please note that this endpoint assumes trustworthy input for the most part. By default, the endpoint checks that
+you do not exceed any quotas, do not sell any seats twice, or do not use any redeemed vouchers. However, it will not
+complain about violation of any other availability constraints, such as violation of time frames or minimum/maximum
+amounts of either your product or event. Bundled products will not be added in automatically and fees will not be
+calculated automatically.
+
+.. sourcecode:: http
+
+    POST /api/v1/organizers/democon/events/3vjrh/orders/ HTTP/1.1
+    Host: test.pretix.eu
+    Accept: application/json, text/javascript
+    Content-Type: application/json
+    Authorization: …
+
+    {
+      "email": "dummy@example.org",
+      "locale": "en",
+      "sales_channel": "web",
+      "payment_provider": "banktransfer",
+      "invoice_address": {
+        "is_business": false,
+        "company": "Sample company",
+        "name_parts": {"full_name": "John Doe"},
+        "street": "Sesam Street 12",
+        "zipcode": "12345",
+        "city": "Sample City",
+        "country": "US",
+        "state": "NY",
+        "internal_reference": "",
+        "vat_id": ""
+      },
+      "positions": [
+        {
+          "item": 21,
+          "variation": null,
+          "attendee_name_parts": {
+            "full_name": "Peter"
+          },
+          "answers": [
+            {
+              "question": 1,
+              "answer": "23",
+              "options": []
+            }
+          ],
+          "subevent": null
+        }
+      ],
+      "fees": []
+    }
+
+You will be returned a full order object that you can inspect, store, or use to build emails or confirmation pages for
+the user. If you don't want to do that yourself, it will also contain the URL to our confirmation page in the ``url``
+attribute. If you pass the ``"send_mail": true`` option, pretix will also send order confirmations for you.
+
+Handling payments yourself
+--------------------------
+
+If you want to handle payments in your application, you can either just create the orders with status "paid" or you can
+create them in "pending" state (the default) and later confirm the payment. We strongly advise to use the payment
+provider ``"manual"`` in this case to avoid interference with payment code with pretix.
+
+However, it is often unfeasible to implement the payment process yourself, and it also requires you to give up a
+lot of pretix functionality, such as automatic refunds. Therefore, it is also possible to utilize pretix' native
+payment process even in this case:
+
+Using pretix payment providers
+------------------------------
+
+If you passed a ``payment_provider`` during order creation above, pretix will have created a payment object with state
+``created`` that you can see in the returned order object. This payment object will have an attribute ``payment_url``
+that you can use to let the user pay. For example, you could link or redirect to this page.
+
+If you want the user to return to your application after the payment is complete, you can pass a query parameter
+``return_url``. To prepare your event for this, open your event in the pretix backend and go to "Settings", then
+"Plugins". Enable the plugin "Redirection from order page". Then, go to the new page "Settings", then "Redirection".
+Enter the base URL of your web application. This will allow you to redirect to pages under this base URL later on.
+For example, if you want users to be redirected to ``https://example.org/order/return?tx_id=1234``, you could now
+either enter ``https://example.org`` or ``https://example.org/order/``.
+
+The user will be redirected back to your page instead of pretix' order confirmation page after the payment,
+**regardless of whether it was successful or not**. Make sure you use our API to check if the payment actually
+worked! Your final URL could look like this::
+
+    https://test.pretix.eu/democon/3vjrh/order/NSLEZ/ujbrnsjzbq4dzhck/pay/123/?return_url=https%3A%2F%2Fexample.org%2Forder%2Freturn%3Ftx_id%3D1234
+
+You can also embed this page in an ``<iframe>`` instead. Note, however, that this causes problems with some payment
+methods such as PayPal which do not allow being opened in an iframe. pretix can partly work around these issues by
+opening a new window, but will only to so if you also append an ``iframe=1`` parameter to the URL::
+
+    https://test.pretix.eu/democon/3vjrh/order/NSLEZ/ujbrnsjzbq4dzhck/pay/123/?return_url=https%3A%2F%2Fexample.org%2Forder%2Freturn%3Ftx_id%3D1234&iframe=1
+
+If you did **not** pass a payment method since you want us to ask the user which payment method they want to use, you
+need to construct the URL from the ``url`` attribute of the order and the sub-path ``pay/change```. For example, you
+would end up with the following URL::
+
+    https://test.pretix.eu/democon/3vjrh/order/NSLEZ/ujbrnsjzbq4dzhck/pay/change
+
+Of course, you can also use the ``iframe`` and ``return_url`` parameters here.
+
+Optional: Cart reservations
+---------------------------
+
+Creating orders is an atomic operation: The order is either created as a whole or not at all. However, pretix'
+built-in checkout automatically reserves tickets in a user's cart for a configurable amount of time to ensure users
+will actually get their tickets once they started entering all their details. If you want a similar behavior in your
+application, you need to create :ref:`rest-carts` through the API.
+
+When creating your order, you can pass a ``consume_carts`` parameter with the cart ID(s) of your user. This way, the
+quota reserved by the cart will be credited towards the order and the carts will be destroyed if (and only if) the
+order creation succeeds.
+
+Cart creation is currently even more limited than the order creation endpoints, as cart creation currently does not
+support vouchers or automatic price calculation. If you require these features, please get in touch with us.

doc/api/guides/index.rst

@@ -0,0 +1,11 @@
+.. _`rest-api-guides`:
+
+API Usage Guides
+================
+
+This part of the documentation contains how-to guides on some special use cases of our API.
+
+.. toctree::
+   :maxdepth: 2
+
+   custom_checkout

doc/api/index.rst

@@ -7,9 +7,6 @@ This part of the documentation contains information about the REST-style API
 exposed by pretix since version 1.5 that can be used by third-party programs
 to interact with pretix and its data structures.
 
-Currently, the API provides mostly read-only capabilities, but it will be extended
-in functionality over time.
-
 .. toctree::
    :maxdepth: 2
 
@@ -18,3 +15,4 @@ in functionality over time.
    resources/index
    ratelimit
    webhooks
+   guides/index

doc/api/oauth.rst

@@ -61,7 +61,7 @@ access to the API. The ``token`` endpoint expects you to authenticate using `HTT
 ID as a username and your client secret as a password. You are also required to again supply the same ``redirect_uri``
 parameter that you used for the authorization.
 
-.. http:get:: /api/v1/oauth/token
+.. http:post:: /api/v1/oauth/token
 
    Request a new access token
 

doc/api/resources/billing_invoices.rst

@@ -0,0 +1,131 @@
+pretix Hosted billing invoices
+==============================
+
+This endpoint allows you to access invoices you received for pretix Hosted. It only contains invoices created starting
+November 2017.
+
+.. note:: Only available on pretix Hosted, not on self-hosted pretix instances.
+
+Resource description
+--------------------
+
+The resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+invoice_number                        string                     Invoice number
+date_issued                           date                       Invoice date
+===================================== ========================== =======================================================
+
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/billing_invoices/
+
+   Returns a list of all invoices to a given organizer.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/billing_invoices/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "invoice_number": "R2019002",
+            "date_issued": "2019-06-03"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``date_issued`` and
+                           its reverse, ``-date_issued``. Default: ``date_issued``.
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/billing_invoices/(invoice_number)/
+
+   Returns information on one invoice, identified by its invoice number.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/billing_invoices/R2019002/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "invoice_number": "R2019002",
+        "date_issued": "2019-06-03"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param invoice_number: The ``invoice_number`` field of the invoice to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/billing_invoices/(invoice_number)/download/
+
+   Download an invoice in PDF format.
+
+   .. warning:: After we created the invoices, they are placed in review with our accounting department. You will
+                already see them in the API at this point, but you are not able to download them until they completed
+                review and are sent to you via email. This usually takes a few hours. If you try to download them
+                in this time frame, you will receive a status code :http:statuscode:`423`.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/billing_invoices/R2019002/download/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/pdf
+
+      ...
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param invoice_number: The ``invoice_number`` field of the invoice to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 423: The file is not yet ready and will now be prepared. Retry the request after waiting for a few
+                    seconds.

doc/api/resources/billing_var.rst

@@ -0,0 +1,148 @@
+pretix Hosted reseller API
+==========================
+
+This API is only accessible to our `value-added reseller partners`_ on pretix Hosted.
+
+.. note:: This API is only accessible with user-level permissions, not with API tokens. Therefore, you will need to
+          create an :ref:`OAuth application <rest-oauth>` and obtain an OAuth access token for a user account that has
+          permission to your reseller account.
+
+Reseller account resource
+-------------------------
+
+The resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Your reseller ID
+name                                  string                     Internal name of your reseller account
+public_name                           string                     Public name of your reseller account
+public_url                            string                     Public URL of your company
+support_email                         string                     Your support email address
+support_phone                         string                     Your support phone number
+communication_language                string                     Language code we use to communicate with you
+===================================== ========================== =======================================================
+
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/var/
+
+   Returns a list of all reseller accounts you have access to.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/var/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": "ticketshop.live Ltd & Co. KG",
+            "public_name": "ticketshop.live",
+            "public_url": "https://ticketshop.live",
+            "support_email": "support@ticketshop.live",
+            "support_phone": "+4962213217750",
+            "communication_language": "de"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+
+.. http:get:: /api/v1/var/(id)/
+
+   Returns information on one reseller account, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/var/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "ticketshop.live Ltd & Co. KG",
+        "public_name": "ticketshop.live",
+        "public_url": "https://ticketshop.live",
+        "support_email": "support@ticketshop.live",
+        "support_phone": "+4962213217750",
+        "communication_language": "de"
+      }
+
+   :param id: The ``id`` field of the reseller account to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 404: The requested account does not exist **or** you have no permission to view this resource.
+
+.. http:post:: /api/v1/var/(id)/create_organizer/
+
+   Creates a new organizer account that will be associated with a given reseller account.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/var/1/create_organizer/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 123
+
+      {
+        "name": "My new client",
+        "slug": "New client"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "My new client",
+        "slug": "New client"
+      }
+
+   :param id: The ``id`` field of the reseller account to fetch
+   :statuscode 201: no error
+   :statuscode 400: Invalid request body, usually the slug is invalid or already taken.
+   :statuscode 401: Authentication failure
+   :statuscode 404: The requested account does not exist **or** you have no permission to view this resource.
+
+.. _value-added reseller partners: https://pretix.eu/about/en/var

doc/api/resources/carts.rst

@@ -36,12 +36,20 @@ answers                               list of objects            Answers to user
 ├ question_identifier                 string                     The question's ``identifier`` field
 ├ options                             list of integers           Internal IDs of selected option(s)s (only for choice types)
 └ option_identifiers                  list of strings            The ``identifier`` fields of the selected option(s)s
+seat                                  objects                    The assigned seat. Can be ``null``.
+├ id                                  integer                    Internal ID of the seat instance
+├ name                                string                     Human-readable seat name
+└ seat_guid                           string                     Identifier of the seat within the seating plan
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 1.17
 
    This resource has been added.
 
+.. versionchanged:: 3.0
+
+   This ``seat`` attribute has been added.
+
 
 Cart position endpoints
 -----------------------
@@ -87,6 +95,7 @@ Cart position endpoints
             "datetime": "2018-06-11T10:00:00Z",
             "expires": "2018-06-11T10:00:00Z",
             "includes_tax": true,
+            "seat": null,
             "answers": []
           }
         ]
@@ -132,6 +141,7 @@ Cart position endpoints
         "datetime": "2018-06-11T10:00:00Z",
         "expires": "2018-06-11T10:00:00Z",
         "includes_tax": true,
+        "seat": null,
         "answers": []
       }
 
@@ -178,11 +188,13 @@ Cart position endpoints
    * ``item``
    * ``variation`` (optional)
    * ``price``
+   * ``seat`` (The ``seat_guid`` attribute of a seat. Required when the specified ``item`` requires a seat, otherwise must be ``null``.)
    * ``attendee_name`` **or** ``attendee_name_parts`` (optional)
    * ``attendee_email`` (optional)
    * ``subevent`` (optional)
    * ``expires`` (optional)
    * ``includes_tax`` (optional)
+   * ``sales_channel`` (optional)
    * ``answers``
 
       * ``question``
@@ -196,7 +208,7 @@ Cart position endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/cartpositions/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "item": 1,

doc/api/resources/categories.rst

@@ -131,7 +131,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/categories/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": {"en": "Tickets"},

doc/api/resources/checkinlists.rst

@@ -1,3 +1,5 @@
+.. spelling:: checkin
+
 Check-in lists
 ==============
 
@@ -27,6 +29,10 @@ subevent                              integer                    ID of the date
 position_count                        integer                    Number of tickets that match this list (read-only).
 checkin_count                         integer                    Number of check-ins performed on this list (read-only).
 include_pending                       boolean                    If ``true``, the check-in list also contains tickets from orders in pending state.
+auto_checkin_sales_channels           list of strings            All items on the check-in list will be automatically marked as checked-in when purchased through any of the listed sales channels.
+allow_multiple_entries                boolean                    If ``true``, subsequent scans of a ticket on this list should not show a warning but instead be stored as an additional check-in.
+allow_entry_after_exit                boolean                    If ``true``, subsequent scans of a ticket on this list are valid if the last scan of the ticket was an exit scan.
+rules                                 object                     Custom check-in logic. The contents of this field are currently not considered a stable API and modifications through the API are highly discouraged.
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 1.10
@@ -41,6 +47,19 @@ include_pending                       boolean                    If ``true``, th
 
    The ``include_pending`` field has been added.
 
+.. versionchanged:: 3.2
+
+    The ``auto_checkin_sales_channels`` field has been added.
+
+.. versionchanged:: 3.9
+
+    The ``subevent`` attribute may now be ``null`` inside event series. The ``allow_multiple_entries``,
+    ``allow_entry_after_exit``, and ``rules`` attributes have been added.
+
+.. versionchanged:: 3.11
+
+    The ``subevent_match`` and ``exclude`` query parameters have been added.
+
 Endpoints
 ---------
 
@@ -81,13 +100,21 @@ Endpoints
             "all_products": true,
             "limit_products": [],
             "include_pending": false,
-            "subevent": null
+            "subevent": null,
+            "allow_multiple_entries": false,
+            "allow_entry_after_exit": true,
+            "rules": {},
+            "auto_checkin_sales_channels": [
+              "pretixpos"
+            ]
           }
         ]
       }
 
    :query integer page: The page number in case of a multi-page result set, default is 1
    :query integer subevent: Only return check-in lists of the sub-event with the given ID
+   :query integer subevent_match: Only return check-in lists that are valid for the sub-event with the given ID (i.e. also lists valid for all subevents)
+   :query string exclude: Exclude a field from the output, e.g. ``checkin_count``. Can be used as a performance optimization. Can be passed multiple times.
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :statuscode 200: no error
@@ -122,7 +149,13 @@ Endpoints
         "all_products": true,
         "limit_products": [],
         "include_pending": false,
-        "subevent": null
+        "subevent": null,
+        "allow_multiple_entries": false,
+        "allow_entry_after_exit": true,
+        "rules": {},
+        "auto_checkin_sales_channels": [
+          "pretixpos"
+        ]
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch
@@ -209,13 +242,18 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/checkinlists/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": "VIP entry",
         "all_products": false,
         "limit_products": [1, 2],
-        "subevent": null
+        "subevent": null,
+        "allow_multiple_entries": false,
+        "allow_entry_after_exit": true,
+        "auto_checkin_sales_channels": [
+          "pretixpos"
+        ]
       }
 
    **Example response**:
@@ -234,7 +272,12 @@ Endpoints
         "all_products": false,
         "limit_products": [1, 2],
         "include_pending": false,
-        "subevent": null
+        "subevent": null,
+        "allow_multiple_entries": false,
+        "allow_entry_after_exit": true,
+        "auto_checkin_sales_channels": [
+          "pretixpos"
+        ]
       }
 
    :param organizer: The ``slug`` field of the organizer of the event/item to create a list for
@@ -283,7 +326,12 @@ Endpoints
         "all_products": false,
         "limit_products": [1, 2],
         "include_pending": false,
-        "subevent": null
+        "subevent": null,
+        "allow_multiple_entries": false,
+        "allow_entry_after_exit": true,
+        "auto_checkin_sales_channels": [
+          "pretixpos"
+        ]
       }
 
    :param organizer: The ``slug`` field of the organizer to modify
@@ -342,6 +390,11 @@ Order position endpoints
    ``ignore_status`` filter. The ``attendee_name`` field is now "smart" (see below) and the redemption endpoint
    returns ``400`` instead of ``404`` on tickets which are known but not paid.
 
+.. versionchanged:: 3.2
+
+    The ``checkins`` dict now also contains a ``auto_checked_in`` value to indicate if the check-in has been performed
+    automatically by the system.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/checkinlists/(list)/positions/
 
    Returns a list of all order positions within a given event. The result is the same as
@@ -396,10 +449,12 @@ Order position endpoints
             "addon_to": null,
             "subevent": null,
             "pseudonymization_id": "MQLJvANO3B",
+            "seat": null,
             "checkins": [
               {
                 "list": 1,
-                "datetime": "2017-12-25T12:45:23Z"
+                "datetime": "2017-12-25T12:45:23Z",
+                "auto_checked_in": true
               }
             ],
             "answers": [
@@ -505,10 +560,12 @@ Order position endpoints
         "addon_to": null,
         "subevent": null,
         "pseudonymization_id": "MQLJvANO3B",
+        "seat": null,
         "checkins": [
           {
             "list": 1,
-            "datetime": "2017-12-25T12:45:23Z"
+            "datetime": "2017-12-25T12:45:23Z",
+            "auto_checked_in": true
           }
         ],
         "answers": [
@@ -546,9 +603,12 @@ Order position endpoints
                                        you do not implement question handling in your user interface, you **must**
                                        set this to ``false``. In that case, questions will just be ignored. Defaults
                                        to ``true``.
+   :<json boolean canceled_supported: When this parameter is set to ``true``, the response code ``canceled`` may be
+                                      returned. Otherwise, canceled orders will return ``unpaid``.
    :<json datetime datetime: Specifies the datetime of the check-in. If not supplied, the current time will be used.
    :<json boolean force: Specifies that the check-in should succeed regardless of previous check-ins or required
                          questions that have not been filled. Defaults to ``false``.
+   :<json string type: Send ``"exit"`` for an exit and ``"entry"`` (default) for an entry.
    :<json boolean ignore_unpaid: Specifies that the check-in should succeed even if the order is in pending state.
                                  Defaults to ``false`` and only works when ``include_pending`` is set on the check-in
                                  list.
@@ -574,6 +634,7 @@ Order position endpoints
         "nonce": "Pvrk50vUzQd0DhdpNRL4I4OcXsvg70uA",
         "datetime": null,
         "questions_supported": true,
+        "canceled_supported": true,
         "answers": {
           "4": "XS"
         }
@@ -657,9 +718,12 @@ Order position endpoints
 
    Possible error reasons:
 
-   * ``unpaid`` - Ticket is not paid for or has been refunded
+   * ``unpaid`` - Ticket is not paid for
+   * ``canceled`` – Ticket is canceled or expired. This reason is only sent when your request sets
+     ``canceled_supported`` to ``true``, otherwise these orders return ``unpaid``.
    * ``already_redeemed`` - Ticket already has been redeemed
    * ``product`` - Tickets with this product may not be scanned at this device
+   * ``rules`` - Check-in prevented by a user-defined rule
 
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch

doc/api/resources/events.rst

@@ -1,3 +1,9 @@
+.. spelling::
+
+   geo
+   lat
+   lon
+
 Events
 ======
 
@@ -25,11 +31,19 @@ is_public                             boolean                    If ``true``, th
 presale_start                         datetime                   The date at which the ticket shop opens (or ``null``)
 presale_end                           datetime                   The date at which the ticket shop closes (or ``null``)
 location                              multi-lingual string       The event location (or ``null``)
+geo_lat                               float                      Latitude of the location (or ``null``)
+geo_lon                               float                      Longitude of the location (or ``null``)
 has_subevents                         boolean                    ``true`` if the event series feature is active for this
                                                                  event. Cannot change after event is created.
-meta_data                             dict                       Values set for organizer-specific meta data parameters.
+meta_data                             object                     Values set for organizer-specific meta data parameters.
 plugins                               list                       A list of package names of the enabled plugins for this
                                                                  event.
+seating_plan                          integer                    If reserved seating is in use, the ID of a seating
+                                                                 plan. Otherwise ``null``.
+seat_category_mapping                 object                     An object mapping categories of the seating plan
+                                                                 (strings) to items in the event (integers or ``null``).
+timezone                              string                     Event timezone name
+item_meta_properties                  object                     Item-specific meta data parameters and default values.
 ===================================== ========================== =======================================================
 
 
@@ -50,9 +64,33 @@ plugins                               list                       A list of packa
 
    The ``testmode`` attribute has been added.
 
+.. versionchanged:: 2.8
+
+    When cloning events, the ``testmode`` attribute will now be cloned, too.
+
+.. versionchanged:: 3.0
+
+   The attributes ``seating_plan`` and ``seat_category_mapping`` have been added.
+
+.. versionchanged:: 3.3
+
+   The attributes ``geo_lat`` and ``geo_lon`` have been added.
+
+.. versionchanged:: 3.4
+
+   The attribute ``timezone`` has been added.
+
+.. versionchanged:: 3.7
+
+   The attribute ``item_meta_properties`` has been added.
+
 Endpoints
 ---------
 
+.. versionchanged:: 3.3
+
+    The events resource can now be filtered by meta data attributes.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/
 
    Returns a list of all events within a given organizer the authenticated user/token has access to.
@@ -93,8 +131,14 @@ Endpoints
             "presale_start": null,
             "presale_end": null,
             "location": null,
+            "geo_lat": null,
+            "geo_lon": null,
             "has_subevents": false,
             "meta_data": {},
+            "seating_plan": null,
+            "seat_category_mapping": {},
+            "timezone": "Europe/Berlin",
+            "item_meta_properties": {},
             "plugins": [
               "pretix.plugins.banktransfer"
               "pretix.plugins.stripe"
@@ -112,6 +156,13 @@ Endpoints
    :query is_future: If set to ``true`` (``false``), only events that happen currently or in the future are (not) returned. Event series are never (always) returned.
    :query is_past: If set to ``true`` (``false``), only events that are over are (not) returned. Event series are never (always) returned.
    :query ends_after: If set to a date and time, only events that happen during of after the given time are returned. Event series are never returned.
+   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``date_from`` and
+                           ``slug``. Keep in mind that ``date_from`` of event series does not really tell you anything.
+                           Default: ``slug``.
+   :query array attr[meta_data_key]: By providing the key and value of a meta data attribute, the list of events will
+        only contain the events matching the set criteria. Providing ``?attr[Format]=Seminar`` would return only those
+        events having set their ``Format`` meta data to ``Seminar``, ``?attr[Format]=`` only those, that have no value
+        set. Please note that this filter will respect default values set on organizer level.
    :param organizer: The ``slug`` field of a valid organizer
    :statuscode 200: no error
    :statuscode 401: Authentication failure
@@ -152,8 +203,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
         "has_subevents": false,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.banktransfer"
           "pretix.plugins.stripe"
@@ -184,7 +241,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": {"en": "Sample Conference"},
@@ -198,9 +255,15 @@ Endpoints
         "is_public": false,
         "presale_start": null,
         "presale_end": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
         "has_subevents": false,
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
@@ -228,8 +291,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "has_subevents": false,
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
@@ -245,11 +314,11 @@ Endpoints
 
 .. http:post:: /api/v1/organizers/(organizer)/events/(event)/clone/
 
-   Creates a new event with properties as set in the request body. The properties that are copied are: 'is_public',
-   settings, plugin settings, items, variations, add-ons, quotas, categories, tax rules, questions.
+   Creates a new event with properties as set in the request body. The properties that are copied are: ``is_public``,
+   ``testmode``, ``has_subevents``, settings, plugin settings, items, variations, add-ons, quotas, categories, tax rules, questions.
 
-   If the 'plugins' and/or 'is_public' fields are present in the post body this will determine their value. Otherwise
-   their value will be copied from the existing event.
+   If the ``plugins``, ``has_subevents`` and/or ``is_public`` fields are present in the post body this will determine their
+   value. Otherwise their value will be copied from the existing event.
 
    Please note that you can only copy from events under the same organizer.
 
@@ -262,7 +331,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/clone/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": {"en": "Sample Conference"},
@@ -277,8 +346,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "has_subevents": false,
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
@@ -306,8 +381,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
         "has_subevents": false,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.stripe",
           "pretix.plugins.paypal"
@@ -335,7 +416,7 @@ Endpoints
       PATCH /api/v1/organizers/bigevents/events/sampleconf/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "plugins": [
@@ -367,8 +448,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
         "has_subevents": false,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "meta_data": {},
+        "timezone": "Europe/Berlin",
+        "item_meta_properties": {},
         "plugins": [
           "pretix.plugins.banktransfer",
           "pretix.plugins.stripe",
@@ -411,3 +498,123 @@ Endpoints
    :statuscode 204: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to delete this resource.
+
+Event settings
+--------------
+
+pretix events have lots and lots of parameters of different types that are stored in a key-value store on our system.
+Since many of these settings depend on each other in complex ways, we can not give direct access to all of these
+settings through the API. However, we do expose many of the simple and useful flags through the API.
+
+Please note that the available settings flags change between pretix versions and also between events, depending on the
+installed plugins, and we do not give a guarantee on backwards-compatibility like with other parts of the API.
+Therefore, we're also not including a list of the options here, but instead recommend to look at the endpoint output
+to see available options. The ``explain=true`` flag enables a verbose mode that provides you with human-readable
+information about the properties.
+
+.. note:: Please note that this is not a complete representation of all event settings. You will find more settings
+          in the web interface.
+
+.. warning:: This API is intended for advanced users. Even though we take care to validate your input, you will be
+             able to break your event using this API by creating situations of conflicting settings. Please take care.
+
+.. versionchanged:: 3.6
+
+   Initial support for settings has been added to the API.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/settings/
+
+   Get current values of event settings.
+
+   Permission required: "Can change event settings" (Exception: with device auth, *some* settings can always be *read*.)
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/settings/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example standard response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "imprint_url": "https://pretix.eu",
+        …
+      }
+
+   **Example verbose response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "imprint_url":
+          {
+            "value": "https://pretix.eu",
+            "label": "Imprint URL",
+            "help_text": "This should point e.g. to a part of your website that has your contact details and legal information."
+          }
+        },
+        …
+      }
+
+   :param organizer: The ``slug`` field of the organizer of the event to access
+   :param event: The ``slug`` field of the event to access
+   :query explain: Set to ``true`` to enable verbose response mode
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/settings/
+
+   Updates event settings. Note that ``PUT`` is not allowed here, only ``PATCH``.
+
+    .. warning::
+
+       Settings can be stored at different levels in pretix. If a value is not set on event level, a default setting
+       from a higher level (organizer, global) will be returned. If you explicitly set a setting on event level, it
+       will no longer be inherited from the higher levels. Therefore, we recommend you to send only settings that you
+       explicitly want to set on event level. To unset a settings, pass ``null``.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/events/sampleconf/settings/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "imprint_url": "https://example.org/imprint/"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "imprint_url": "https://example.org/imprint/",
+        …
+      }
+
+   :param organizer: The ``slug`` field of the organizer of the event to update
+   :param event: The ``slug`` field of the event to update
+   :statuscode 200: no error
+   :statuscode 400: The event could not be updated due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to create this resource.

doc/api/resources/giftcards.rst

@@ -0,0 +1,251 @@
+.. _`rest-giftcards`:
+
+Gift cards
+==========
+
+Resource description
+--------------------
+
+The gift card resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the gift card
+secret                                string                     Gift card code (can not be modified later)
+value                                 money (string)             Current gift card value
+currency                              string                     Currency of the value (can not be modified later)
+testmode                              boolean                    Whether this is a test gift card
+expires                               datetime                   Expiry date (or ``null``)
+conditions                            string                     Special terms and conditions for this card (or ``null``)
+===================================== ========================== =======================================================
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/giftcards/
+
+   Returns a list of all gift cards issued by a given organizer.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/giftcards/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "secret": "HLBYVELFRC77NCQY",
+            "currency": "EUR",
+            "testmode": false,
+            "expires": null,
+            "conditions": null,
+            "value": "13.37"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :query string secret: Only show gift cards with the given secret.
+   :query boolean testmode: Filter for gift cards that are (not) in test mode.
+   :query boolean include_accepted: Also show gift cards issued by other organizers that are accepted by this organizer.
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/giftcards/(id)/
+
+   Returns information on one gift card, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/giftcards/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "secret": "HLBYVELFRC77NCQY",
+        "currency": "EUR",
+        "testmode": false,
+        "expires": null,
+        "conditions": null,
+        "value": "13.37"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param id: The ``id`` field of the gift card to fetch
+   :query boolean include_accepted: Also show gift cards issued by other organizers that are accepted by this organizer.
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:post:: /api/v1/organizers/(organizer)/giftcards/
+
+   Creates a new gift card
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/giftcards/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "secret": "HLBYVELFRC77NCQY",
+        "currency": "EUR",
+        "value": "13.37"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "secret": "HLBYVELFRC77NCQY",
+        "testmode": false,
+        "currency": "EUR",
+        "expires": null,
+        "conditions": null,
+        "value": "13.37"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create a gift card for
+   :statuscode 201: no error
+   :statuscode 400: The gift card could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/giftcards/(id)/
+
+   Update a gift card. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   You can change all fields of the resource except the ``id``, ``secret``, ``testmode``, and ``currency`` fields. Be
+   careful when modifying the ``value`` field to avoid race conditions. We recommend to use the ``transact`` method
+   described below.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/giftcards/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "value": "14.00"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "secret": "HLBYVELFRC77NCQY",
+        "testmode": false,
+        "currency": "EUR",
+        "expires": null,
+        "conditions": null,
+        "value": "14.00"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the gift card to modify
+   :statuscode 200: no error
+   :statuscode 400: The gift card could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
+
+.. http:post:: /api/v1/organizers/(organizer)/giftcards/(id)/transact/
+
+   Atomically change the value of a gift card. A positive amount will increase the value of the gift card,
+   a negative amount will decrease it.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/giftcards/1/transact/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "value": "2.00"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "secret": "HLBYVELFRC77NCQY",
+        "currency": "EUR",
+        "testmode": false,
+        "expires": null,
+        "conditions": null,
+        "value": "15.37"
+      }
+
+   .. versionchanged:: 3.5
+
+      This endpoint now returns status code ``409`` if the transaction would lead to a negative gift card value.
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the gift card to modify
+   :query boolean include_accepted: Also show gift cards issued by other organizers that are accepted by this organizer.
+   :statuscode 200: no error
+   :statuscode 400: The gift card could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
+   :statuscode 409: There is not sufficient credit on the gift card.

doc/api/resources/index.rst

@@ -21,5 +21,10 @@ Resources and endpoints
    vouchers
    checkinlists
    waitinglist
+   giftcards
    carts
+   teams
    webhooks
+   seatingplans
+   billing_invoices
+   billing_var

doc/api/resources/invoices.rst

@@ -28,6 +28,7 @@ payment_provider_text                 string                     Text to be prin
                                                                  payment information
 footer_text                           string                     Text to be printed in the page footer area
 lines                                 list of objects            The actual invoice contents
+├ position                            integer                    Number of the line within an invoice.
 ├ description                         string                     Text representing the invoice line (e.g. product name)
 ├ gross_value                         money (string)             Price including taxes
 ├ tax_value                           money (string)             Tax amount included
@@ -63,6 +64,11 @@ internal_reference                    string                     Customer's refe
    The attribute ``internal_reference`` has been added.
 
 
+.. versionchanged:: 3.4
+
+   The attribute ``lines.number`` has been added.
+
+
 Endpoints
 ---------
 
@@ -107,6 +113,7 @@ Endpoints
             "footer_text": "Big Events LLC - Registration No. 123456 - VAT ID: EU0987654321",
             "lines": [
               {
+                "position": 1,
                 "description": "Budget Ticket",
                 "gross_value": "23.00",
                 "tax_value": "0.00",
@@ -171,6 +178,7 @@ Endpoints
         "footer_text": "Big Events LLC - Registration No. 123456 - VAT ID: EU0987654321",
         "lines": [
           {
+            "position": 1,
             "description": "Budget Ticket",
             "gross_value": "23.00",
             "tax_value": "0.00",

doc/api/resources/item_add-ons.rst

@@ -24,6 +24,7 @@ addon_category                        integer                    Internal ID of
 min_count                             integer                    The minimal number of add-ons that need to be chosen.
 max_count                             integer                    The maximal number of add-ons that can be chosen.
 position                              integer                    An integer, used for sorting
+multi_allowed                         boolean                    Adding the same item multiple times is allowed
 price_included                        boolean                    Adding this add-on to the item is free
 ===================================== ========================== =======================================================
 
@@ -65,6 +66,7 @@ Endpoints
             "min_count": 0,
             "max_count": 10,
             "position": 0,
+            "multi_allowed": false,
             "price_included": true
           },
           {
@@ -73,6 +75,7 @@ Endpoints
             "min_count": 0,
             "max_count": 10,
             "position": 1,
+            "multi_allowed": false,
             "price_included": true
           }
         ]
@@ -112,6 +115,7 @@ Endpoints
         "min_count": 0,
         "max_count": 10,
         "position": 1,
+        "multi_allowed": false,
         "price_included": true
       }
 
@@ -134,13 +138,14 @@ Endpoints
       POST /api/v1/organizers/(organizer)/events/(event)/items/(item)/addons/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "addon_category": 1,
         "min_count": 0,
         "max_count": 10,
         "position": 1,
+        "multi_allowed": false,
         "price_included": true
       }
 
@@ -158,6 +163,7 @@ Endpoints
         "min_count": 0,
         "max_count": 10,
         "position": 1,
+        "multi_allowed": false,
         "price_included": true
       }
 
@@ -206,6 +212,7 @@ Endpoints
         "min_count": 0,
         "max_count": 10,
         "position": 1,
+        "multi_allowed": false,
         "price_included": true
       }
 

doc/api/resources/item_bundles.rst

@@ -134,7 +134,7 @@ Endpoints
       POST /api/v1/organizers/(organizer)/events/(event)/items/(item)/bundles/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "bundled_item": 3,

doc/api/resources/item_variations.rst

@@ -152,7 +152,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/items/1/variations/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "value": {"en": "Student"},

doc/api/resources/items.rst

@@ -44,6 +44,9 @@ available_from                        datetime                   The first date
                                                                  (or ``null``).
 available_until                       datetime                   The last date time at which this item can be bought
                                                                  (or ``null``).
+hidden_if_available                   integer                    The internal ID of a quota object, or ``null``. If
+                                                                 set, this item won't be shown publicly as long as this
+                                                                 quota is available.
 require_voucher                       boolean                    If ``true``, this item can only be bought using a
                                                                  voucher that is specifically assigned to this item.
 hide_without_voucher                  boolean                    If ``true``, this item is only shown during the voucher
@@ -72,6 +75,11 @@ generate_tickets                      boolean                    If ``false``, t
                                                                  non-admission or add-on product, regardless of event
                                                                  settings. If this is ``null``, regular ticketing
                                                                  rules apply.
+allow_waitinglist                     boolean                    If ``false``, no waiting list will be shown for this
+                                                                 product when it is sold out.
+issue_giftcard                        boolean                    If ``true``, buying this product will yield a gift card.
+show_quota_left                       boolean                    Publicly show how many tickets are still available.
+                                                                 If this is ``null``, the event default is used.
 has_variations                        boolean                    Shows whether or not this item has variations.
 variations                            list of objects            A list with one object for each variation of this item.
                                                                  Can be empty. Only writable during creation,
@@ -96,6 +104,7 @@ addons                                list of objects            Definition of a
 ├ min_count                           integer                    The minimal number of add-ons that need to be chosen.
 ├ max_count                           integer                    The maximal number of add-ons that can be chosen.
 ├ position                            integer                    An integer, used for sorting
+├ multi_allowed                       boolean                    Adding the same item multiple times is allowed
 └ price_included                      boolean                    Adding this add-on to the item is free
 bundles                               list of objects            Definition of bundles that are included in this item.
                                                                  Only writable during creation,
@@ -106,6 +115,7 @@ bundles                               list of objects            Definition of b
 └ designated_price                    money (string)             Designated price of the bundled product. This will be
                                                                  used to split the price of the base item e.g. for mixed
                                                                  taxation. This is not added to the price.
+meta_data                             object                     Values set for event-specific meta data parameters.
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 2.7
@@ -142,6 +152,18 @@ bundles                               list of objects            Definition of b
 
    The ``bundles`` and ``require_bundling`` attributes have been added.
 
+.. versionchanged:: 3.0
+
+   The ``show_quota_left``, ``allow_waitinglist``, and ``hidden_if_available`` attributes have been added.
+
+.. versionchanged:: 3.7
+
+   The attribute ``meta_data`` has been added.
+
+.. versionchanged:: 3.10
+
+   The attribute ``multi_allowed`` has been added to ``addons``.
+
 Notes
 -----
 
@@ -195,10 +217,13 @@ Endpoints
             "tax_rate": "0.00",
             "tax_rule": 1,
             "admission": false,
+            "issue_giftcard": false,
+            "meta_data": {},
             "position": 0,
             "picture": null,
             "available_from": null,
             "available_until": null,
+            "hidden_if_available": null,
             "require_voucher": false,
             "hide_without_voucher": false,
             "allow_cancel": true,
@@ -207,6 +232,8 @@ Endpoints
             "checkin_attention": false,
             "has_variations": false,
             "generate_tickets": null,
+            "allow_waitinglist": true,
+            "show_quota_left": null,
             "require_approval": false,
             "require_bundling": false,
             "variations": [
@@ -286,14 +313,19 @@ Endpoints
         "tax_rate": "0.00",
         "tax_rule": 1,
         "admission": false,
+        "issue_giftcard": false,
+        "meta_data": {},
         "position": 0,
         "picture": null,
         "available_from": null,
         "available_until": null,
+        "hidden_if_available": null,
         "require_voucher": false,
         "hide_without_voucher": false,
         "allow_cancel": true,
         "generate_tickets": null,
+        "allow_waitinglist": true,
+        "show_quota_left": null,
         "min_per_order": null,
         "max_per_order": null,
         "checkin_attention": false,
@@ -342,7 +374,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/items/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "id": 1,
@@ -358,14 +390,19 @@ Endpoints
         "tax_rate": "0.00",
         "tax_rule": 1,
         "admission": false,
+        "issue_giftcard": false,
+        "meta_data": {},
         "position": 0,
         "picture": null,
         "available_from": null,
         "available_until": null,
+        "hidden_if_available": null,
         "require_voucher": false,
         "hide_without_voucher": false,
         "allow_cancel": true,
         "generate_tickets": null,
+        "allow_waitinglist": true,
+        "show_quota_left": null,
         "min_per_order": null,
         "max_per_order": null,
         "checkin_attention": false,
@@ -417,16 +454,21 @@ Endpoints
         "tax_rate": "0.00",
         "tax_rule": 1,
         "admission": false,
+        "issue_giftcard": false,
+        "meta_data": {},
         "position": 0,
         "picture": null,
         "available_from": null,
         "available_until": null,
+        "hidden_if_available": null,
         "require_voucher": false,
         "hide_without_voucher": false,
         "allow_cancel": true,
         "min_per_order": null,
         "max_per_order": null,
         "generate_tickets": null,
+        "allow_waitinglist": true,
+        "show_quota_left": null,
         "checkin_attention": false,
         "has_variations": true,
         "require_approval": false,
@@ -508,13 +550,18 @@ Endpoints
         "tax_rate": "0.00",
         "tax_rule": 1,
         "admission": false,
+        "issue_giftcard": false,
+        "meta_data": {},
         "position": 0,
         "picture": null,
         "available_from": null,
         "available_until": null,
+        "hidden_if_available": null,
         "require_voucher": false,
         "hide_without_voucher": false,
         "generate_tickets": null,
+        "allow_waitinglist": true,
+        "show_quota_left": null,
         "allow_cancel": true,
         "min_per_order": null,
         "max_per_order": null,

doc/api/resources/orders.rst

@@ -53,15 +53,18 @@ invoice_address                       object                     Invoice address
 ├ street                              string                     Customer street
 ├ zipcode                             string                     Customer ZIP code
 ├ city                                string                     Customer city
-├ country                             string                     Customer country
+├ country                             string                     Customer country code
+├ state                               string                     Customer state (ISO 3166-2 code). Only supported in
+                                                                 AU, BR, CA, CN, MY, MX, and US.
 ├ internal_reference                  string                     Customer's internal reference to be printed on the invoice
 ├ vat_id                              string                     Customer VAT ID
 └ vat_id_validated                    string                     ``true``, if the VAT ID has been validated against the
                                                                  EU VAT service and validation was successful. This only
                                                                  happens in rare cases.
-positions                             list of objects            List of non-canceled order positions (see below)
-fees                                  list of objects            List of non-canceled fees included in the order total
-                                                                 (i.e. payment fees)
+positions                             list of objects            List of order positions (see below). By default, only
+                                                                 non-canceled positions are included.
+fees                                  list of objects            List of fees included in the order total. By default, only
+                                                                 non-canceled fees are included.
 ├ fee_type                            string                     Type of fee (currently ``payment``, ``passbook``,
                                                                  ``other``)
 ├ value                               money (string)             Fee amount
@@ -70,7 +73,8 @@ fees                                  list of objects            List of non-can
                                                                  can be empty
 ├ tax_rate                            decimal (string)           VAT rate applied for this fee
 ├ tax_value                           money (string)             VAT included in this fee
-└ tax_rule                            integer                    The ID of the used tax rule (or ``null``)
+├ tax_rule                            integer                    The ID of the used tax rule (or ``null``)
+└ canceled                            boolean                    Whether or not this fee has been canceled.
 downloads                             list of objects            List of ticket download options for order-wise ticket
                                                                  downloading. This might be a multi-page PDF or a ZIP
                                                                  file of tickets for outputs that do not support
@@ -82,6 +86,7 @@ require_approval                      boolean                    If ``true`` and
                                                                  needs approval by an organizer before it can
                                                                  continue. If ``true`` and the order is canceled,
                                                                  this order has been denied by the event organizer.
+url                                   string                     The full URL to the order confirmation page
 payments                              list of objects            List of payment processes (see below)
 refunds                               list of objects            List of refund processes (see below)
 last_modified                         datetime                   Last modification of this object
@@ -128,15 +133,37 @@ last_modified                         datetime                   Last modificati
 
    The ``sales_channel`` attribute has been added.
 
-.. versionchanged:: 2.4:
+.. versionchanged:: 2.4
 
    ``order.status`` can no longer be ``r``, ``…/mark_canceled/`` now accepts a ``cancellation_fee`` parameter and
    ``…/mark_refunded/`` has been deprecated.
 
-.. versionchanged:: 2.5:
+.. versionchanged:: 2.5
 
    The ``testmode`` attribute has been added and ``DELETE`` has been implemented for orders.
 
+.. versionchanged:: 3.1
+
+   The ``invoice_address.state`` and ``url`` attributes have been added. When creating orders through the API,
+   vouchers are now supported and many fields are now optional.
+
+.. versionchanged:: 3.5
+
+   The ``order.fees.canceled`` attribute has been added.
+
+.. versionchanged:: 3.8
+
+   The ``reactivate`` operation has been added.
+
+.. versionchanged:: 3.10
+
+   The ``search`` query parameter has been added.
+
+.. versionchanged:: 3.11
+
+   The ``exclude`` and ``subevent_after`` query parameter has been added.
+
+
 .. _order-position-resource:
 
 Order position resource
@@ -150,12 +177,21 @@ Field                                 Type                       Description
 id                                    integer                    Internal ID of the order position
 order                                 string                     Order code of the order the position belongs to
 positionid                            integer                    Number of the position within the order
+canceled                              boolean                    Whether or not this position has been canceled. Note that
+                                                                 by default, only non-canceled positions are shown.
 item                                  integer                    ID of the purchased item
 variation                             integer                    ID of the purchased variation (or ``null``)
 price                                 money (string)             Price of this position
 attendee_name                         string                     Specified attendee name for this position (or ``null``)
 attendee_name_parts                   object of strings          Decomposition of attendee name (i.e. given name, family name)
 attendee_email                        string                     Specified attendee email address for this position (or ``null``)
+company                               string                     Attendee company name (or ``null``)
+street                                string                     Attendee street (or ``null``)
+zipcode                               string                     Attendee ZIP code (or ``null``)
+city                                  string                     Attendee city (or ``null``)
+country                               string                     Attendee country code (or ``null``)
+state                                 string                     Attendee state (ISO 3166-2 code). Only supported in
+                                                                 AU, BR, CA, CN, MY, MX, and US, otherwise ``null``.
 voucher                               integer                    Internal ID of the voucher used for this position (or ``null``)
 tax_rate                              decimal (string)           VAT rate applied for this position
 tax_value                             money (string)             VAT included in this position
@@ -166,7 +202,9 @@ subevent                              integer                    ID of the date
 pseudonymization_id                   string                     A random ID, e.g. for use in lead scanning apps
 checkins                              list of objects            List of check-ins with this ticket
 ├ list                                integer                    Internal ID of the check-in list
-└ datetime                            datetime                   Time of check-in
+├ datetime                            datetime                   Time of check-in
+├ type                                string                     Type of scan (defaults to ``entry``)
+└ auto_checked_in                     boolean                    Indicates if this check-in been performed automatically by the system
 downloads                             list of objects            List of ticket download options
 ├ output                              string                     Ticket output provider (e.g. ``pdf``, ``passbook``)
 └ url                                 string                     Download URL
@@ -176,6 +214,10 @@ answers                               list of objects            Answers to user
 ├ question_identifier                 string                     The question's ``identifier`` field
 ├ options                             list of integers           Internal IDs of selected option(s)s (only for choice types)
 └ option_identifiers                  list of strings            The ``identifier`` fields of the selected option(s)s
+seat                                  objects                    The assigned seat. Can be ``null``.
+├ id                                  integer                    Internal ID of the seat instance
+├ name                                string                     Human-readable seat name
+└ seat_guid                           string                     Identifier of the seat within the seating plan
 pdf_data                              object                     Data object required for ticket PDF generation. By default,
                                                                  this field is missing. It will be added only if you add the
                                                                  ``pdf_data=true`` query parameter to your request.
@@ -197,6 +239,31 @@ pdf_data                              object                     Data object req
 
   The attributes ``pseudonymization_id`` and ``pdf_data`` have been added.
 
+.. versionchanged:: 3.0
+
+  The attribute ``seat`` has been added.
+
+.. versionchanged:: 3.2
+
+  The value ``auto_checked_in`` has been added to the ``checkins``-attribute.
+
+.. versionchanged:: 3.3
+
+  The ``url`` of a ticket ``download`` can now also return a ``text/uri-list`` instead of a file. See
+  :ref:`order-position-ticket-download` for details.
+
+.. versionchanged:: 3.5
+
+  The attribute ``canceled`` has been added.
+
+.. versionchanged:: 3.8
+
+  The attributes ``company``, ``street``, ``zipcode``, ``city``, ``country``, and ``state`` have been added.
+
+.. versionchanged:: 3.9
+
+  The ``checkin.type`` attribute has been added.
+
 .. _order-payment-resource:
 
 Order payment resource
@@ -213,13 +280,27 @@ amount                                money (string)             Payment amount
 created                               datetime                   Date and time of creation of this payment
 payment_date                          datetime                   Date and time of completion of this payment (or ``null``)
 provider                              string                     Identification string of the payment provider
+payment_url                           string                     The URL where an user can continue with the payment (or ``null``)
+details                               object                     Payment-specific information. This is a dictionary
+                                                                 with various fields that can be different between
+                                                                 payment providers, versions, payment states, etc. If
+                                                                 you read this field, you always need to be able to
+                                                                 deal with situations where values that you expect are
+                                                                 missing. Mostly, the field contains various IDs that
+                                                                 can be used for matching with other systems. If a
+                                                                 payment provider does not implement this feature,
+                                                                 the object is empty.
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 2.0
 
   This resource has been added.
 
-.. _order-payment-resource:
+.. versionchanged:: 3.1
+
+  The attributes ``payment_url`` and ``details`` have been added.
+
+.. _order-refund-resource:
 
 Order refund resource
 ---------------------
@@ -249,6 +330,10 @@ List of all orders
 
    Filtering for emails or order codes is now case-insensitive.
 
+.. versionchanged:: 3.5
+
+   The ``include_canceled_positions`` and ``include_canceled_fees`` query parameters have been added.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/orders/
 
    Returns a list of all orders within a given event.
@@ -280,6 +365,7 @@ List of all orders
             "status": "p",
             "testmode": false,
             "secret": "k24fiuwvu8kxz3y1",
+            "url": "https://test.pretix.eu/dummy/dummy/order/ABC12/k24fiuwvu8kxz3y1/",
             "email": "tester@example.org",
             "locale": "en",
             "sales_channel": "web",
@@ -302,7 +388,8 @@ List of all orders
                 "street": "Test street 12",
                 "zipcode": "12345",
                 "city": "Testington",
-                "country": "Testikistan",
+                "country": "DE",
+                "state": "",
                 "internal_reference": "",
                 "vat_id": "EU123456789",
                 "vat_id_validated": false
@@ -312,6 +399,7 @@ List of all orders
                 "id": 23442,
                 "order": "ABC12",
                 "positionid": 1,
+                "canceled": false,
                 "item": 1345,
                 "variation": null,
                 "price": "23.00",
@@ -320,6 +408,12 @@ List of all orders
                   "full_name": "Peter",
                 },
                 "attendee_email": null,
+                "company": "Sample company",
+                "street": "Test street 12",
+                "zipcode": "12345",
+                "city": "Testington",
+                "country": "DE",
+                "state": null,
                 "voucher": null,
                 "tax_rate": "0.00",
                 "tax_value": "0.00",
@@ -328,10 +422,13 @@ List of all orders
                 "addon_to": null,
                 "subevent": null,
                 "pseudonymization_id": "MQLJvANO3B",
+                "seat": null,
                 "checkins": [
                   {
                     "list": 44,
-                    "datetime": "2017-12-25T12:45:23Z"
+                    "type": "entry",
+                    "datetime": "2017-12-25T12:45:23Z",
+                    "auto_checked_in": false
                   }
                 ],
                 "answers": [
@@ -364,6 +461,8 @@ List of all orders
                 "amount": "23.00",
                 "created": "2017-12-01T10:00:00Z",
                 "payment_date": "2017-12-04T12:13:12Z",
+                "payment_url": null,
+                "details": {},
                 "provider": "banktransfer"
               }
             ],
@@ -377,15 +476,21 @@ List of all orders
                            ``last_modified``, and ``status``. Default: ``datetime``
    :query string code: Only return orders that match the given order code
    :query string status: Only return orders in the given order status (see above)
+   :query string search: Only return orders matching a given search query
    :query boolean testmode: Only return orders with ``testmode`` set to ``true`` or ``false``
    :query boolean require_approval: If set to ``true`` or ``false``, only categories with this value for the field
                                     ``require_approval`` will be returned.
+   :query include_canceled_positions: If set to ``true``, the output will contain canceled order positions. Note that this
+                                      only affects position-level cancellations, not fully-canceled orders.
+   :query include_canceled_fees: If set to ``true``, the output will contain canceled order fees.
    :query string email: Only return orders created with the given email address
    :query string locale: Only return orders with the given customer locale
    :query datetime modified_since: Only return orders that have changed since the given date. Be careful: We only
        recommend using this in combination with ``testmode=false``, since test mode orders can vanish at any time and
        you will not notice it using this method.
    :query datetime created_since: Only return orders that have been created since the given date.
+   :query datetime subevent_after: Only return orders that contain a ticket for a subevent taking place after the given date.
+   :query string exclude: Exclude a field from the output, e.g. ``fees`` or ``positions.downloads``. Can be used as a performance optimization. Can be passed multiple times.
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :resheader X-Page-Generated: The server time at the beginning of the operation. If you're using this API to fetch
@@ -397,6 +502,10 @@ List of all orders
 Fetching individual orders
 --------------------------
 
+.. versionchanged:: 3.5
+
+   The ``include_canceled_positions`` and ``include_canceled_fees`` query parameters have been added.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/orders/(code)/
 
    Returns information on one order, identified by its order code.
@@ -422,6 +531,7 @@ Fetching individual orders
         "status": "p",
         "testmode": false,
         "secret": "k24fiuwvu8kxz3y1",
+        "url": "https://test.pretix.eu/dummy/dummy/order/ABC12/k24fiuwvu8kxz3y1/",
         "email": "tester@example.org",
         "locale": "en",
         "sales_channel": "web",
@@ -444,7 +554,8 @@ Fetching individual orders
             "street": "Test street 12",
             "zipcode": "12345",
             "city": "Testington",
-            "country": "Testikistan",
+            "country": "DE",
+            "state": "",
             "internal_reference": "",
             "vat_id": "EU123456789",
             "vat_id_validated": false
@@ -454,6 +565,7 @@ Fetching individual orders
             "id": 23442,
             "order": "ABC12",
             "positionid": 1,
+            "canceled": false,
             "item": 1345,
             "variation": null,
             "price": "23.00",
@@ -462,6 +574,12 @@ Fetching individual orders
               "full_name": "Peter",
             },
             "attendee_email": null,
+            "company": "Sample company",
+            "street": "Test street 12",
+            "zipcode": "12345",
+            "city": "Testington",
+            "country": "DE",
+            "state": null,
             "voucher": null,
             "tax_rate": "0.00",
             "tax_rule": null,
@@ -470,10 +588,13 @@ Fetching individual orders
             "addon_to": null,
             "subevent": null,
             "pseudonymization_id": "MQLJvANO3B",
+            "seat": null,
             "checkins": [
               {
                 "list": 44,
-                "datetime": "2017-12-25T12:45:23Z"
+                "type": "entry",
+                "datetime": "2017-12-25T12:45:23Z",
+                "auto_checked_in": false
               }
             ],
             "answers": [
@@ -506,6 +627,8 @@ Fetching individual orders
             "amount": "23.00",
             "created": "2017-12-01T10:00:00Z",
             "payment_date": "2017-12-04T12:13:12Z",
+            "payment_url": null,
+            "details": {},
             "provider": "banktransfer"
           }
         ],
@@ -515,6 +638,9 @@ Fetching individual orders
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :param code: The ``code`` field of the order to fetch
+   :query include_canceled_positions: If set to ``true``, the output will contain canceled order positions. Note that this
+                                      only affects position-level cancellations, not fully-canceled orders.
+   :query include_canceled_fees: If set to ``true``, the output will contain canceled order fees.
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
@@ -681,6 +807,8 @@ Deleting orders
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to delete this resource **or** the order may not be deleted.
    :statuscode 404: The requested order does not exist.
 
+.. _rest-orders-create:
+
 Creating orders
 ---------------
 
@@ -688,8 +816,6 @@ Creating orders
 
    Creates a new order.
 
-   .. warning:: This endpoint is considered **experimental**. It might change at any time without prior notice.
-
    .. warning::
 
        This endpoint is intended for advanced users. It is not designed to be used to build your own shop frontend,
@@ -708,25 +834,21 @@ Creating orders
 
        * does not validate the number of items per order or the number of times an item can be included in an order
 
-       * does not validate any requirements related to add-on products
+       * does not validate any requirements related to add-on products and does not add bundled products automatically
 
-       * does not check or calculate prices but believes any prices you send
-
-       * does not support the redemption of vouchers
+       * does not check prices but believes any prices you send
 
        * does not prevent you from buying items that can only be bought with a voucher
 
-       * does not calculate fees
+       * does not calculate fees automatically
 
        * does not allow to pass data to plugins and will therefore cause issues with some plugins like the shipping
          module
 
-       * does not send order confirmations via email
-
-       * does not support reverse charge taxation
-
        * does not support file upload questions
 
+       * does not support redeeming gift cards
+
    You can supply the following fields of the resource:
 
    * ``code`` (optional)
@@ -737,14 +859,15 @@ Creating orders
      then call the ``mark_paid`` API method.
    * ``testmode`` (optional) – Defaults to ``false``
    * ``consume_carts`` (optional) – A list of cart IDs. All cart positions with these IDs will be deleted if the
-     order creation is successful. Any quotas that become free by this operation will be credited to your order
+     order creation is successful. Any quotas or seats that become free by this operation will be credited to your order
      creation.
-   * ``email``
+   * ``email`` (optional)
    * ``locale``
-   * ``sales_channel``
-   * ``payment_provider`` – The identifier of the payment provider set for this order. This needs to be an existing
-     payment provider. You should use ``"free"`` for free orders, and we strongly advise to use ``"manual"`` for all
-     orders you create as paid.
+   * ``sales_channel`` (optional)
+   * ``payment_provider`` (optional) – The identifier of the payment provider set for this order. This needs to be an
+     existing payment provider. You should use ``"free"`` for free orders, and we strongly advise to use ``"manual"``
+     for all orders you create as paid. This field is optional when the order status is ``"n"`` or the order total is
+     zero, otherwise it is required.
    * ``payment_info`` (optional) – You can pass a nested JSON object that will be set as the internal ``info``
      value of the payment object that will be created. How this value is handled is up to the payment provider and you
      should only use this if you know the specific payment provider in detail. Please keep in mind that the payment
@@ -762,20 +885,32 @@ Creating orders
       * ``zipcode``
       * ``city``
       * ``country``
+      * ``state``
       * ``internal_reference``
       * ``vat_id``
+      * ``vat_id_validated`` (optional) – If you need support for reverse charge (rarely the case), you need to check
+       yourself if the passed VAT ID is a valid EU VAT ID. In that case, set this to ``true``. Only valid VAT IDs will
+       trigger reverse charge taxation. Don't forget to set ``is_business`` as well!
 
    * ``positions``
 
       * ``positionid`` (optional, see below)
       * ``item``
-      * ``variation``
-      * ``price``
-      * ``attendee_name`` **or** ``attendee_name_parts``
-      * ``attendee_email``
+      * ``variation`` (optional)
+      * ``price`` (optional, if set to ``null`` or missing the price will be computed from the given product)
+      * ``seat`` (The ``seat_guid`` attribute of a seat. Required when the specified ``item`` requires a seat, otherwise must be ``null``.)
+      * ``attendee_name`` **or** ``attendee_name_parts`` (optional)
+      * ``voucher`` (optional, the ``code`` attribute of a valid voucher)
+      * ``attendee_email`` (optional)
+      * ``company`` (optional)
+      * ``street`` (optional)
+      * ``zipcode`` (optional)
+      * ``city`` (optional)
+      * ``country`` (optional)
+      * ``state`` (optional)
       * ``secret`` (optional)
       * ``addon_to`` (optional, see below)
-      * ``subevent``
+      * ``subevent`` (optional)
       * ``answers``
 
         * ``question``
@@ -789,14 +924,32 @@ Creating orders
       * ``description``
       * ``internal_type``
       * ``tax_rule``
+      * ``_treat_value_as_percentage`` (Optional convenience flag. If set to ``true``, your ``value`` parameter will
+        be treated as a percentage and the fee will be calculated using that percentage and the sum of all product
+        prices. Note that this will not include other fees and is calculated once during order generation and will not
+        be respected automatically when the order changes later.)
+      * ``_split_taxes_like_products`` (Optional convenience flag. If set to ``true``, your ``tax_rule`` will be ignored
+        and the fee will be taxed like the products in the order. If the products have multiple tax rates, multiple fees
+        will be generated with weights adjusted to the net price of the products. Note that this will be calculated once
+        during order generation and is not respected automatically when the order changes later.)
 
    * ``force`` (optional). If set to ``true``, quotas will be ignored.
+   * ``send_mail`` (optional). If set to ``true``, the same emails will be sent as for a regular order, regardless of
+     whether these emails are enabled for certain sales channels. Defaults to
+     ``false``.
 
    If you want to use add-on products, you need to set the ``positionid`` fields of all positions manually
    to incrementing integers starting with ``1``. Then, you can reference one of these
    IDs in the ``addon_to`` field of another position. Note that all add_ons for a specific position need to come
    immediately after the position itself.
 
+   Starting with pretix 3.7, you can add ``"simulate": true`` to the body to do a "dry run" of your order. This will
+   validate your order and return you an order object with the resulting prices, but will not create an actual order.
+   You can use this for testing or to look up prices. In this case, some attributes are ignored, such as whether
+   to send an email or what payment provider will be used. Note that some returned fields will contain empty values
+   (e.g. all ``id`` fields of positions will be zero) and some will contain fake values (e.g. the order code will
+   always be ``PREVIEW``). pretix plugins will not be triggered, so some special behavior might be missing as well.
+
    **Example request**:
 
    .. sourcecode:: http
@@ -828,6 +981,7 @@ Creating orders
           "zipcode": "12345",
           "city": "Sample City",
           "country": "UK",
+          "state": "",
           "internal_reference": "",
           "vat_id": ""
         },
@@ -851,7 +1005,7 @@ Creating orders
             ],
             "subevent": null
           }
-        ],
+        ]
       }
 
    **Example response**:
@@ -955,6 +1109,42 @@ Order state operations
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order does not exist.
 
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/orders/(code)/reactivate/
+
+   Reactivates a canceled order. This will set the order to pending or paid state. Only possible if all products are
+   still available.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/orders/ABC12/reactivate/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "code": "ABC12",
+        "status": "n",
+        ...
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param code: The ``code`` field of the order to modify
+   :statuscode 200: no error
+   :statuscode 400: The order cannot be reactivated
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested order does not exist.
+
 .. http:post:: /api/v1/organizers/(organizer)/events/(event)/orders/(code)/mark_pending/
 
    Marks a paid order as unpaid.
@@ -1242,7 +1432,13 @@ List of all order positions
    The order positions endpoint has been extended by the filter queries ``voucher``, ``voucher__code`` and
    ``pseudonymization_id``.
 
-.. note:: Individually canceled order positions are currently not visible via the API at all.
+.. versionchanged:: 3.2
+
+  The value ``auto_checked_in`` has been added to the ``checkins``-attribute.
+
+.. versionchanged:: 3.5
+
+   The ``include_canceled_positions`` and ``include_canceled_fees`` query parameters have been added.
 
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/orderpositions/
 
@@ -1273,6 +1469,7 @@ List of all order positions
             "id": 23442,
             "order": "ABC12",
             "positionid": 1,
+            "canceled": false,
             "item": 1345,
             "variation": null,
             "price": "23.00",
@@ -1287,12 +1484,15 @@ List of all order positions
             "tax_value": "0.00",
             "secret": "z3fsn8jyufm5kpk768q69gkbyr5f4h6w",
             "pseudonymization_id": "MQLJvANO3B",
+            "seat": null,
             "addon_to": null,
             "subevent": null,
             "checkins": [
               {
                 "list": 44,
-                "datetime": "2017-12-25T12:45:23Z"
+                "type": "entry",
+                "datetime": "2017-12-25T12:45:23Z",
+                "auto_checked_in": false
               }
             ],
             "answers": [
@@ -1340,6 +1540,8 @@ List of all order positions
                                 comma-separated IDs.
    :query string voucher: Only return positions with a specific voucher.
    :query string voucher__code: Only return positions with a specific voucher code.
+   :query include_canceled_positions: If set to ``true``, the output will contain canceled order positions. Note that this
+                                      only affects position-level cancellations, not fully-canceled orders.
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :statuscode 200: no error
@@ -1373,6 +1575,7 @@ Fetching individual positions
         "id": 23442,
         "order": "ABC12",
         "positionid": 1,
+        "canceled": false,
         "item": 1345,
         "variation": null,
         "price": "23.00",
@@ -1389,10 +1592,13 @@ Fetching individual positions
         "addon_to": null,
         "subevent": null,
         "pseudonymization_id": "MQLJvANO3B",
+        "seat": null,
         "checkins": [
           {
             "list": 44,
-            "datetime": "2017-12-25T12:45:23Z"
+            "type": "entry",
+            "datetime": "2017-12-25T12:45:23Z",
+            "auto_checked_in": false
           }
         ],
         "answers": [
@@ -1415,11 +1621,14 @@ Fetching individual positions
    :param organizer: The ``slug`` field of the organizer to fetch
    :param event: The ``slug`` field of the event to fetch
    :param id: The ``id`` field of the order position to fetch
+   :query include_canceled_positions: If set to ``true``, canceled positions may be returned (otherwise, they return 404).
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order position does not exist.
 
+.. _`order-position-ticket-download`:
+
 Order position ticket download
 ------------------------------
 
@@ -1429,6 +1638,11 @@ Order position ticket download
    Depending on the chosen output, the response might be a ZIP file, PDF file or something else. The order details
    response contains a list of output options for this particular order position.
 
+   Be aware that the output does not have to be a file, but can also be a regular HTTP response with a ``Content-Type``
+   set to ``text/uri-list``. In this case, the user is expected to navigate to that URL in order to access their ticket.
+   The referenced URL can provide a download or a regular, human-viewable website - so it is advised to open this URL
+   in a webbrowser and leave it up to the user to handle the result.
+
    Tickets can be only downloaded if the order is paid and if ticket downloads are active. Also, depending on event
    configuration downloads might be only unavailable for add-on products or non-admission products.
    Note that in some cases the ticket file might not yet have been created. In that case, you will receive a status
@@ -1504,6 +1718,10 @@ Order payment endpoints
 
   These endpoints have been added.
 
+.. versionchanged:: 3.6
+
+   Payments can now be created through the API.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/orders/(code)/payments/
 
    Returns a list of all payments for an order.
@@ -1535,6 +1753,8 @@ Order payment endpoints
             "amount": "23.00",
             "created": "2017-12-01T10:00:00Z",
             "payment_date": "2017-12-04T12:13:12Z",
+            "payment_url": null,
+            "details": {},
             "provider": "banktransfer"
           }
         ]
@@ -1575,6 +1795,8 @@ Order payment endpoints
         "amount": "23.00",
         "created": "2017-12-01T10:00:00Z",
         "payment_date": "2017-12-04T12:13:12Z",
+        "payment_url": null,
+        "details": {},
         "provider": "banktransfer"
       }
 
@@ -1708,6 +1930,61 @@ Order payment endpoints
    :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
    :statuscode 404: The requested order or payment does not exist.
 
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/orders/(code)/payments/
+
+   Creates a new payment.
+
+   Be careful with the ``info`` parameter: You can pass a nested JSON object that will be set as the internal ``info``
+   value of the payment object that will be created. How this value is handled is up to the payment provider and you
+   should only use this if you know the specific payment provider in detail. Please keep in mind that the payment
+   provider will not be called to do anything about this (i.e. if you pass a bank account to a debit provider, *no*
+   charge will be created), this is just informative in case you *handled the payment already*.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/orders/ABC12/payments/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "state": "confirmed",
+        "amount": "23.00",
+        "payment_date": "2017-12-04T12:13:12Z",
+        "info": {},
+        "provider": "banktransfer"
+      }
+
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "local_id": 1,
+        "state": "confirmed",
+        "amount": "23.00",
+        "created": "2017-12-01T10:00:00Z",
+        "payment_date": "2017-12-04T12:13:12Z",
+        "payment_url": null,
+        "details": {},
+        "provider": "banktransfer"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to access
+   :param event: The ``slug`` field of the event to access
+   :param order: The ``code`` field of the order to access
+   :statuscode 201: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested order does not exist.
+
 
 Order refund endpoints
 ----------------------
@@ -1826,7 +2103,8 @@ Order refund endpoints
         "payment": 1,
         "execution_date": null,
         "provider": "manual",
-        "mark_canceled": false
+        "mark_canceled": false,
+        "mark_pending": true
       }
 
    **Example response**:

doc/api/resources/organizers.rst

@@ -56,6 +56,8 @@ Endpoints
       }
 
    :query page: The page number in case of a multi-page result set, default is 1
+   :query string ordering: Manually set the ordering of results. Valid fields to be used are ``slug`` and
+                           ``name``. Default: ``slug``.
    :statuscode 200: no error
    :statuscode 401: Authentication failure
 

doc/api/resources/questions.rst

@@ -18,6 +18,7 @@ Field                                 Type                       Description
 ===================================== ========================== =======================================================
 id                                    integer                    Internal ID of the question
 question                              multi-lingual string       The field label shown to the customer
+help_text                             multi-lingual string       The help text shown to the customer
 type                                  string                     The expected type of answer. Valid options:
 
                                                                  * ``N`` – number
@@ -30,6 +31,8 @@ type                                  string                     The expected ty
                                                                  * ``D`` – date
                                                                  * ``H`` – time
                                                                  * ``W`` – date and time
+                                                                 * ``CC`` – country code (ISO 3666-1 alpha-2)
+                                                                 * ``TEL`` – telephone number
 required                              boolean                    If ``true``, the question needs to be filled out.
 position                              integer                    An integer, used for sorting
 items                                 list of integers           List of item IDs this question is assigned to.
@@ -38,6 +41,10 @@ identifier                            string                     An arbitrary st
 ask_during_checkin                    boolean                    If ``true``, this question will not be asked while
                                                                  buying the ticket, but will show up when redeeming
                                                                  the ticket instead.
+hidden                                boolean                    If ``true``, the question will only be shown in the
+                                                                 backend.
+print_on_invoice                      boolean                    If ``true``, the question will only be shown on
+                                                                 invoices.
 options                               list of objects            In case of question type ``C`` or ``M``, this lists the
                                                                  available objects. Only writable during creation,
                                                                  use separate endpoint to modify this later.
@@ -51,11 +58,12 @@ dependency_question                   integer                    Internal ID of
                                                                  this attribute is set to the value given in
                                                                  ``dependency_value``. This cannot be combined with
                                                                  ``ask_during_checkin``.
-dependency_value                      string                     The value ``dependency_question`` needs to be set to.
-                                                                 If ``dependency_question`` is set to a boolean
-                                                                 question, this should be ``"true"`` or ``"false"``.
-                                                                 Otherwise, it should be the ``identifier`` of a
-                                                                 question option.
+dependency_values                     list of strings            If ``dependency_question`` is set to a boolean
+                                                                 question, this should be ``["True"]`` or ``["False"]``.
+                                                                 Otherwise, it should be a list of ``identifier`` values
+                                                                 of question options.
+dependency_value                      string                     An old version of ``dependency_values`` that only allows
+                                                                 for one value. **Deprecated.**
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 1.12
@@ -68,6 +76,22 @@ dependency_value                      string                     The value ``dep
   Write methods have been added. The attribute ``identifier`` has been added to both the resource itself and the
   options resource. The ``position`` attribute has been added to the options resource.
 
+.. versionchanged:: 2.7
+
+  The attribute ``hidden`` and the question type ``CC`` have been added.
+
+.. versionchanged:: 3.0
+
+  The attribute ``dependency_values`` has been added.
+
+.. versionchanged:: 3.1
+
+  The attribute ``print_on_invoice`` has been added.
+
+.. versionchanged:: 3.5
+
+  The attribute ``help_text`` has been added.
+
 Endpoints
 ---------
 
@@ -104,14 +128,18 @@ Endpoints
           {
             "id": 1,
             "question": {"en": "T-Shirt size"},
+            "help_text": {"en": "Choose your preferred t-shirt-size"},
             "type": "C",
             "required": false,
             "items": [1, 2],
             "position": 1,
             "identifier": "WY3TP9SL",
             "ask_during_checkin": false,
+            "hidden": false,
+            "print_on_invoice": false,
             "dependency_question": null,
             "dependency_value": null,
+            "dependency_values": [],
             "options": [
               {
                 "id": 1,
@@ -171,14 +199,18 @@ Endpoints
       {
         "id": 1,
         "question": {"en": "T-Shirt size"},
+        "help_text": {"en": "Choose your preferred t-shirt-size"},
         "type": "C",
         "required": false,
         "items": [1, 2],
         "position": 1,
         "identifier": "WY3TP9SL",
         "ask_during_checkin": false,
+        "hidden": false,
+        "print_on_invoice": false,
         "dependency_question": null,
         "dependency_value": null,
+        "dependency_values": [],
         "options": [
           {
             "id": 1,
@@ -219,17 +251,20 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/questions/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "question": {"en": "T-Shirt size"},
+        "help_text": {"en": "Choose your preferred t-shirt-size"},
         "type": "C",
         "required": false,
         "items": [1, 2],
         "position": 1,
         "ask_during_checkin": false,
+        "hidden": false,
+        "print_on_invoice": false,
         "dependency_question": null,
-        "dependency_value": null,
+        "dependency_values": [],
         "options": [
           {
             "answer": {"en": "S"}
@@ -255,14 +290,18 @@ Endpoints
       {
         "id": 1,
         "question": {"en": "T-Shirt size"},
+        "help_text": {"en": "Choose your preferred t-shirt-size"},
         "type": "C",
         "required": false,
         "items": [1, 2],
         "position": 1,
         "identifier": "WY3TP9SL",
         "ask_during_checkin": false,
+        "hidden": false,
+        "print_on_invoice": false,
         "dependency_question": null,
         "dependency_value": null,
+        "dependency_values": [],
         "options": [
           {
             "id": 1,
@@ -326,14 +365,18 @@ Endpoints
       {
         "id": 1,
         "question": {"en": "T-Shirt size"},
+        "help_text": {"en": "Choose your preferred t-shirt-size"},
         "type": "C",
         "required": false,
         "items": [1, 2],
         "position": 2,
         "identifier": "WY3TP9SL",
         "ask_during_checkin": false,
+        "hidden": false,
+        "print_on_invoice": false,
         "dependency_question": null,
         "dependency_value": null,
+        "dependency_values": [],
         "options": [
           {
             "id": 1,

doc/api/resources/quotas.rst

@@ -20,12 +20,28 @@ size                                  integer                    The size of the
 items                                 list of integers           List of item IDs this quota acts on.
 variations                            list of integers           List of item variation IDs this quota acts on.
 subevent                              integer                    ID of the date inside an event series this quota belongs to (or ``null``).
+close_when_sold_out                   boolean                    If ``true``, the quota will "close" as soon as it is
+                                                                 sold out once. Even if tickets become available again,
+                                                                 they will not be sold unless the quota is set to open
+                                                                 again.
+closed                                boolean                    Whether the quota is currently closed (see above
+                                                                 field).
+release_after_exit                    boolean                    Whether the quota regains capacity as soon as some tickets
+                                                                 have been scanned at an exit.
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 1.10
 
    The write operations ``POST``, ``PATCH``, ``PUT``, and ``DELETE`` have been added.
 
+.. versionchanged:: 3.0
+
+   The attributes ``close_when_sold_out`` and ``closed`` have been added.
+
+.. versionchanged:: 3.10
+
+   The attribute ``release_after_exit`` has been added.
+
 
 Endpoints
 ---------
@@ -61,7 +77,9 @@ Endpoints
             "size": 200,
             "items": [1, 2],
             "variations": [1, 4, 5, 7],
-            "subevent": null
+            "subevent": null,
+            "close_when_sold_out": false,
+            "closed": false
           }
         ]
       }
@@ -102,7 +120,9 @@ Endpoints
         "size": 200,
         "items": [1, 2],
         "variations": [1, 4, 5, 7],
-        "subevent": null
+        "subevent": null,
+        "close_when_sold_out": false,
+        "closed": false
       }
 
    :param organizer: The ``slug`` field of the organizer to fetch
@@ -123,14 +143,16 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/quotas/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": "Ticket Quota",
         "size": 200,
         "items": [1, 2],
         "variations": [1, 4, 5, 7],
-        "subevent": null
+        "subevent": null,
+        "close_when_sold_out": false,
+        "closed": false
       }
 
    **Example response**:
@@ -147,7 +169,9 @@ Endpoints
         "size": 200,
         "items": [1, 2],
         "variations": [1, 4, 5, 7],
-        "subevent": null
+        "subevent": null,
+        "close_when_sold_out": false,
+        "closed": false
       }
 
    :param organizer: The ``slug`` field of the organizer of the event/item to create a quota for
@@ -200,7 +224,9 @@ Endpoints
           1,
           2
         ],
-        "subevent": null
+        "subevent": null,
+        "close_when_sold_out": false,
+        "closed": false
       }
 
    :param organizer: The ``slug`` field of the organizer to modify
@@ -263,6 +289,7 @@ Endpoints
         "total_size": 1000,
         "pending_orders": 25,
         "paid_orders": 423,
+        "exited_orders": 0,
         "cart_positions": 7,
         "blocking_vouchers": 126,
         "waiting_list": 0

doc/api/resources/seatingplans.rst

@@ -0,0 +1,209 @@
+.. _`rest-seatingplans`:
+
+Seating plans
+=============
+
+Resource description
+--------------------
+
+The seating plan resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the plan
+name                                  string                     Human-readable name of the plan
+layout                                object                     JSON representation of the seating plan. These
+                                                                 representations follow a JSON schema that currently
+                                                                 still evolves. The version in use can be found `here`_.
+===================================== ========================== =======================================================
+
+.. versionchanged:: 3.0
+
+   This endpoint has been added.
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/seatingplans/
+
+   Returns a list of all seating plans within a given organizer.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/seatingplans/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 2,
+            "name": "Main plan",
+            "layout": { … }
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/seatingplans/(id)/
+
+   Returns information on one plan, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/seatingplans/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 2,
+        "name": "Main plan",
+        "layout": { … }
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param id: The ``id`` field of the seating plan to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:post:: /api/v1/organizers/(organizer)/seatingplans/
+
+   Creates a new seating plan
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/seatingplans/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "name": "Main plan",
+        "layout": { … }
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 3,
+        "name": "Main plan",
+        "layout": { … }
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create a seating plan for
+   :statuscode 201: no error
+   :statuscode 400: The seating plan could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/seatingplans/(id)/
+
+   Update a plan. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   You can change all fields of the resource except the ``id`` field. **You can not change a plan while it is in use for
+   any events.**
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/seatingplans/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "name": "Old plan"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "Old plan",
+        "layout": { … }
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the plan to modify
+   :statuscode 200: no error
+   :statuscode 400: The plan could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource **or** the plan is currently in use.
+
+.. http:delete:: /api/v1/organizers/(organizer)/seatingplans/(id)/
+
+   Delete a plan. You can not delete plans which are currently in use by any events.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/seatingplans/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the plan to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to delete this resource **or** the plan is currently in use.
+
+
+.. _here: https://github.com/pretix/pretix/blob/master/src/pretix/static/seating/seating-plan.schema.json

doc/api/resources/subevents.rst

@@ -1,3 +1,9 @@
+.. spelling::
+
+   geo
+   lat
+   lon
+
 .. _rest-subevents:
 
 Event series dates / Sub-events
@@ -28,15 +34,23 @@ date_admission                        datetime                   The sub-event's
 presale_start                         datetime                   The sub-date at which the ticket shop opens (or ``null``)
 presale_end                           datetime                   The sub-date at which the ticket shop closes (or ``null``)
 location                              multi-lingual string       The sub-event location (or ``null``)
+geo_lat                               float                      Latitude of the location (or ``null``)
+geo_lon                               float                      Longitude of the location (or ``null``)
 item_price_overrides                  list of objects            List of items for which this sub-event overrides the
                                                                  default price
 ├ item                                integer                    The internal item ID
+├ disabled                            boolean                    If ``true``, item should not be available for this sub-event
 └ price                               money (string)             The price or ``null`` for the default price
 variation_price_overrides             list of objects            List of variations for which this sub-event overrides
                                                                  the default price
 ├ variation                           integer                    The internal variation ID
+├ disabled                            boolean                    If ``true``, variation should not be available for this sub-event
 └ price                               money (string)             The price or ``null`` for the default price
-meta_data                             dict                       Values set for organizer-specific meta data parameters.
+meta_data                             object                     Values set for organizer-specific meta data parameters.
+seating_plan                          integer                    If reserved seating is in use, the ID of a seating
+                                                                 plan. Otherwise ``null``.
+seat_category_mapping                 object                     An object mapping categories of the seating plan
+                                                                 (strings) to items in the event (integers or ``null``).
 ===================================== ========================== =======================================================
 
 .. versionchanged:: 1.7
@@ -54,9 +68,25 @@ meta_data                             dict                       Values set for
 
    The attribute ``is_public`` has been added.
 
+.. versionchanged:: 3.0
+
+   The attributes ``seating_plan`` and ``seat_category_mapping`` have been added.
+
+.. versionchanged:: 3.3
+
+   The attributes ``geo_lat`` and ``geo_lon`` have been added.
+
+.. versionchanged:: 3.10
+
+   The ``disabled`` attribute has been added to ``item_price_overrides`` and ``variation_price_overrides``.
+
 Endpoints
 ---------
 
+.. versionchanged:: 3.3
+
+    The sub-events resource can now be filtered by meta data attributes.
+
 .. http:get:: /api/v1/organizers/(organizer)/events/(event)/subevents/
 
    Returns a list of all sub-events of an event.
@@ -93,10 +123,15 @@ Endpoints
             "date_admission": null,
             "presale_start": null,
             "presale_end": null,
+            "seating_plan": null,
+            "seat_category_mapping": {},
             "location": null,
+            "geo_lat": null,
+            "geo_lon": null,
             "item_price_overrides": [
               {
                 "item": 2,
+                "disabled": false,
                 "price": "12.00"
               }
             ],
@@ -113,6 +148,11 @@ Endpoints
    :query ends_after: If set to a date and time, only events that happen during of after the given time are returned.
    :param organizer: The ``slug`` field of a valid organizer
    :param event: The ``slug`` field of the main event
+   :query array attr[meta_data_key]: By providing the key and value of a meta data attribute, the list of sub-events
+        will only contain the sub-events matching the set criteria. Providing ``?attr[Format]=Seminar`` would return
+        only those sub-events having set their ``Format`` meta data to ``Seminar``, ``?attr[Format]=`` only those, that
+        have no value set. Please note that this filter will respect default values set on 
+        organizer or event level.
    :statuscode 200: no error
    :statuscode 401: Authentication failure
    :statuscode 403: The requested organizer does not exist **or** you have no permission to view it.
@@ -130,7 +170,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/events/sampleconf/subevents/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": {"en": "First Sample Conference"},
@@ -142,9 +182,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "item_price_overrides": [
           {
             "item": 2,
+            "disabled": false,
             "price": "12.00"
           }
         ],
@@ -172,9 +217,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "item_price_overrides": [
           {
             "item": 2,
+            "disabled": false,
             "price": "12.00"
           }
         ],
@@ -223,9 +273,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "item_price_overrides": [
           {
             "item": 2,
+            "disabled": false,
             "price": "12.00"
           }
         ],
@@ -255,13 +310,14 @@ Endpoints
       PATCH /api/v1/organizers/bigevents/events/sampleconf/subevents/1/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "name": {"en": "New Subevent Name"},
         "item_price_overrides": [
           {
             "item": 2,
+            "disabled": false,
             "price": "23.42"
           }
         ],
@@ -287,9 +343,14 @@ Endpoints
         "presale_start": null,
         "presale_end": null,
         "location": null,
+        "geo_lat": null,
+        "geo_lon": null,
+        "seating_plan": null,
+        "seat_category_mapping": {},
         "item_price_overrides": [
           {
             "item": 2,
+            "disabled": false,
             "price": "23.42"
           }
         ],
@@ -371,9 +432,14 @@ Endpoints
             "presale_start": null,
             "presale_end": null,
             "location": null,
+            "geo_lat": null,
+            "geo_lon": null,
+            "seating_plan": null,
+            "seat_category_mapping": {},
             "item_price_overrides": [
               {
                 "item": 2,
+                "disabled": false,
                 "price": "12.00"
               }
             ],

doc/api/resources/teams.rst

@@ -0,0 +1,671 @@
+.. spelling:: fullname
+
+.. _`rest-teams`:
+
+Teams
+=====
+
+.. warning:: Unlike our user interface, the team API **does** allow you to lock yourself out by deleting or modifying
+             the team your user or API key belongs to. Be careful around here!
+
+Team resource
+-------------
+
+The team resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the team
+name                                  string                     Team name
+all_events                            boolean                    Whether this team has access to all events
+limit_events                          list                       List of event slugs this team has access to
+can_create_events                     boolean
+can_change_teams                      boolean
+can_change_organizer_settings         boolean
+can_manage_gift_cards                 boolean
+can_change_event_settings             boolean
+can_change_items                      boolean
+can_view_orders                       boolean
+can_change_orders                     boolean
+can_view_vouchers                     boolean
+can_change_vouchers                   boolean
+===================================== ========================== =======================================================
+
+Team member resource
+--------------------
+
+The team member resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the user
+email                                 string                     The user's email address
+fullname                              string                     The user's full name (or ``null``)
+require_2fa                           boolean                    Whether this user uses two-factor-authentication
+===================================== ========================== =======================================================
+
+Team invite resource
+--------------------
+
+The team invite resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the invite
+email                                 string                     The invitee's email address
+===================================== ========================== =======================================================
+
+Team API token resource
+-----------------------
+
+The team API token resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal ID of the invite
+name                                  string                     Name of this API token
+active                                boolean                    Whether this API token is active (can never be set to
+                                                                 ``true`` again once ``false``)
+token                                 string                     The actual API token. Will only be sent back during
+                                                                 token creation.
+===================================== ========================== =======================================================
+
+Team endpoints
+--------------
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/
+
+   Returns a list of all teams within a given organizer.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "name": "Admin team",
+            "all_events": true,
+            "limit_events": [],
+            "can_create_events": true,
+            ...
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(id)/
+
+   Returns information on one team, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "Admin team",
+        "all_events": true,
+        "limit_events": [],
+        "can_create_events": true,
+        ...
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param id: The ``id`` field of the team to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+
+.. http:post:: /api/v1/organizers/(organizer)/teams/
+
+   Creates a new team
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/teams/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+
+      {
+        "name": "Admin team",
+        "all_events": true,
+        "limit_events": [],
+        "can_create_events": true,
+        ...
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 2,
+        "name": "Admin team",
+        "all_events": true,
+        "limit_events": [],
+        "can_create_events": true,
+        ...
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create a team for
+   :statuscode 201: no error
+   :statuscode 400: The team could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+
+.. http:patch:: /api/v1/organizers/(organizer)/teams/(id)/
+
+   Update a team. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/teams/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "can_create_events": true
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "Admin team",
+        "all_events": true,
+        "limit_events": [],
+        "can_create_events": true,
+        ...
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the team to modify
+   :statuscode 200: no error
+   :statuscode 400: The team could not be modified due to invalid submitted data
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
+
+.. http:delete:: /api/v1/organizers/(organizer)/teams/(id)/
+
+   Deletes a team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/teams/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param id: The ``id`` field of the team to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to change this resource.
+
+Team member endpoints
+---------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/members/
+
+   Returns a list of all members of a team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/members/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "fullname": "John Doe",
+            "email": "john@example.com",
+            "require_2fa": true
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team does not exist
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/members/(id)/
+
+   Returns information on one team member, identified by their ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/members/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "fullname": "John Doe",
+        "email": "john@example.com",
+        "require_2fa": true
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :param id: The ``id`` field of the member to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team or member does not exist
+
+.. http:delete:: /api/v1/organizers/(organizer)/teams/(team)/members/(id)/
+
+   Removes a member from the team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/teams/1/members/1/ HTTP/1.1
+      Host: pretix.eu
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param team: The ``id`` field of the team to modify
+   :param id: The ``id`` field of the member to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+   :statuscode 404: The requested team or member does not exist
+
+Team invite endpoints
+---------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/invites/
+
+   Returns a list of all invitations to a team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/invites/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "email": "john@example.com"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team does not exist
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/invites/(id)/
+
+   Returns information on one invite, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/invites/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "email": "john@example.org"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :param id: The ``id`` field of the invite to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team or invite does not exist
+
+.. http:post:: /api/v1/organizers/(organizer)/teams/(team)/invites/
+
+   Invites someone into the team. Note that if the user already has a pretix account, you will receive a response without
+   an ``id`` and instead of an invite being created, the user will be directly added to the team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/teams/1/invites/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "email": "mark@example.org"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "email": "mark@example.org"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param team: The ``id`` field of the team to modify
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+   :statuscode 404: The requested team does not exist
+
+.. http:delete:: /api/v1/organizers/(organizer)/teams/(team)/invites/(id)/
+
+   Revokes an invite.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/teams/1/invites/1/ HTTP/1.1
+      Host: pretix.eu
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param team: The ``id`` field of the team to modify
+   :param id: The ``id`` field of the invite to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+   :statuscode 404: The requested team or invite does not exist
+
+Team API token endpoints
+------------------------
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/tokens/
+
+   Returns a list of all API tokens of a team.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/tokens/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "active": true,
+            "name": "Test token"
+          }
+        ]
+      }
+
+   :query integer page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team does not exist
+
+.. http:get:: /api/v1/organizers/(organizer)/teams/(team)/tokens/(id)/
+
+   Returns information on one token, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/teams/1/tokens/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "active": true,
+        "name": "Test token"
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param team: The ``id`` field of the team to fetch
+   :param id: The ``id`` field of the token to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to view this resource.
+   :statuscode 404: The requested team or token does not exist
+
+.. http:post:: /api/v1/organizers/(organizer)/teams/(team)/tokens/
+
+   Creates a new token.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/teams/1/tokens/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 94
+
+      {
+        "name": "New token"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 2,
+        "name": "New token",
+        "active": true,
+        "token": "",
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param team: The ``id`` field of the team to create a token for
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+   :statuscode 404: The requested team does not exist
+
+.. http:delete:: /api/v1/organizers/(organizer)/teams/(team)/tokens/(id)/
+
+   Disables a token.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/teams/1/tokens/1/ HTTP/1.1
+      Host: pretix.eu
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "name": "My token",
+        "active": false
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param team: The ``id`` field of the team to modify
+   :param id: The ``id`` field of the token to delete
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer does not exist **or** you have no permission to create this resource.
+   :statuscode 404: The requested team or token does not exist

doc/api/resources/vouchers.rst

@@ -38,9 +38,11 @@ quota                                 integer                    An ID of a quot
                                                                  attached either to a specific product or to all
                                                                  products within one quota or it can be available
                                                                  for all items without restriction.
+seat                                  string                     ``seat_guid`` attribute of a specific seat (or ``null``)
 tag                                   string                     A string that is used for grouping vouchers
 comment                               string                     An internal comment on the voucher
 subevent                              integer                    ID of the date inside an event series this voucher belongs to (or ``null``).
+show_hidden_items                     boolean                    Only if set to ``true``, this voucher allows to buy products with the property ``hide_without_voucher``. Defaults to ``true``.
 ===================================== ========================== =======================================================
 
 
@@ -48,6 +50,14 @@ subevent                              integer                    ID of the date
 
    The write operations ``POST``, ``PATCH``, ``PUT``, and ``DELETE`` have been added.
 
+.. versionchanged:: 3.0
+
+   The attribute ``show_hidden_items`` has been added.
+
+.. versionchanged:: 3.4
+
+   The attribute ``seat`` has been added.
+
 Endpoints
 ---------
 
@@ -91,7 +101,8 @@ Endpoints
             "quota": null,
             "tag": "testvoucher",
             "comment": "",
-            "subevent": null
+            "seat": null,
+            "subevent": null,
           }
         ]
       }
@@ -157,6 +168,7 @@ Endpoints
         "quota": null,
         "tag": "testvoucher",
         "comment": "",
+        "seat": null,
         "subevent": null
       }
 
@@ -220,6 +232,7 @@ Endpoints
         "quota": null,
         "tag": "testvoucher",
         "comment": "",
+        "seat": null,
         "subevent": null
       }
 
@@ -347,6 +360,7 @@ Endpoints
         "quota": null,
         "tag": "testvoucher",
         "comment": "",
+        "seat": null,
         "subevent": null
       }
 

doc/api/resources/webhooks.rst

@@ -137,7 +137,7 @@ Endpoints
       POST /api/v1/organizers/bigevents/webhooks/ HTTP/1.1
       Host: pretix.eu
       Accept: application/json, text/javascript
-      Content: application/json
+      Content-Type: application/json
 
       {
         "enabled": true,

doc/api/webhooks.rst

@@ -70,6 +70,9 @@ and ``checkin_list``.
              only include the minimum amount of data necessary for you to fetch the changed objects from our
              :ref:`rest-api` in an authenticated way.
 
+.. warning:: In very rare cases, you could receive the same webhook notification twice. We try to avoid it, but we
+             prefer it over missing a notification.
+
 If you want to further prevent others from accessing your webhook URL, you can also use `Basic authentication`_ and
 supply the URL to us in the format of ``https://username:password@domain.com/path/``.
 We recommend that you use HTTPS for your webhook URL and might require it in the future. If HTTPS is used, we require

doc/conf.py

@@ -66,7 +66,7 @@ source_suffix = '.rst'
 #source_encoding = 'utf-8-sig'
 
 # The master toctree document.
-master_doc = 'contents'
+master_doc = 'index'
 
 # General information about the project.
 project = 'pretix'
@@ -234,7 +234,7 @@ latex_elements = {
 # (source start file, target name, title,
 #  author, documentclass [howto, manual, or own class]).
 latex_documents = [
-  ('contents', 'pretix.tex', 'pretix Documentation',
+  ('index', 'pretix.tex', 'pretix Documentation',
    'Raphael Michel', 'manual'),
 ]
 

doc/development/api/auth.rst

@@ -0,0 +1,70 @@
+.. highlight:: python
+   :linenothreshold: 5
+
+Pluggable authentication backends
+=================================
+
+Plugins can supply additional authentication backends. This is mainly useful in self-hosted installations
+and allows you to use company-wide login mechanisms such as LDAP or OAuth for accessing pretix' backend.
+
+Every authentication backend contains an implementation of the interface defined in ``pretix.base.auth.BaseAuthBackend``
+(see below). Note that pretix authentication backends work differently than plain Django authentication backends.
+Basically, three pre-defined flows are supported:
+
+* Authentication mechanisms that rely on a **set of input parameters**, e.g. a username and a password. These can be
+  implemented by supplying the ``login_form_fields`` property and a ``form_authenticate`` method.
+
+* Authentication mechanisms that rely on **external sessions**, e.g. a cookie or a proxy HTTP header. These can be
+  implemented by supplying a ``request_authenticate`` method.
+
+* Authentication mechanisms that rely on **redirection**, e.g. to an OAuth provider. These can be implemented by
+  supplying a ``authentication_url`` method and implementing a custom return view.
+
+Authentication backends are *not* collected through a signal. Instead, they must explicitly be set through the
+``auth_backends`` directive in the ``pretix.cfg`` :ref:`configuration file <config>`.
+
+In each of these methods (``form_authenticate``, ``request_authenticate`` or your custom view) you are supposed to
+either get an existing :py:class:`pretix.base.models.User` object from the database or create a new one. There are a
+few rules you need to follow:
+
+* You **MUST** only return users with the ``auth_backend`` attribute set to the ``identifier`` value of your backend.
+
+* You **MUST** create new users with the ``auth_backend`` attribute set to the ``identifier`` value of your backend.
+
+* Every user object **MUST** have an email address. Email addresses are globally unique. If the email address is
+  already registered to a user who signs in through a different backend, you **SHOULD** refuse the login.
+
+The backend interface
+---------------------
+
+.. class:: pretix.base.auth.BaseAuthBackend
+
+   The central object of each backend is the subclass of ``BaseAuthBackend``.
+
+   .. autoattribute:: identifier
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: verbose_name
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: login_form_fields
+
+   .. autoattribute:: visible
+
+   .. automethod:: form_authenticate
+
+   .. automethod:: request_authenticate
+
+   .. automethod:: authentication_url
+
+Logging users in
+----------------
+
+If you return a user from ``form_authenticate`` or ``request_authenticate``, the system will handle everything else
+for you correctly. However, if you use a redirection method and build a custom view to verify the login, we strongly
+recommend that you use the following utility method to correctly set session values and enforce two-factor
+authentication (if activated):
+
+.. autofunction:: pretix.control.views.auth.process_login

doc/development/api/customview.rst

@@ -66,7 +66,7 @@ event-related views, there is also a signal that allows you to add the view to t
 
     from django.urls import resolve, reverse
     from django.dispatch import receiver
-    from django.utils.translation import ugettext_lazy as _
+    from django.utils.translation import gettext_lazy as _
     from pretix.control.signals import nav_event
 
 

doc/development/api/email.rst

@@ -101,9 +101,12 @@ The template is passed the following context variables:
    The ``Event`` object
 
 ``signature`` (optional, only if configured)
-   The body as markdown (render with ``{{ signature|safe }}``)
+   The signature with event organizer contact details as markdown (render with ``{{ signature|safe }}``)
 
 ``order`` (optional, only if applicable)
    The ``Order`` object
 
+``position`` (optional, only if applicable)
+   The ``OrderPosition`` object
+
 .. _inlinestyler: https://pypi.org/project/inlinestyler/

doc/development/api/exporter.rst

@@ -29,6 +29,22 @@ that we'll provide in this plugin::
         from .exporter import MyExporter
         return MyExporter
 
+Some exporters might also prove to be useful, when provided on an organizer-level. In order to declare your
+exporter as capable of providing exports spanning multiple events, your plugin should listen for this signal
+and return the subclass of ``pretix.base.exporter.BaseExporter`` that we'll provide in this plugin::
+
+    from django.dispatch import receiver
+
+    from pretix.base.signals import register_multievent_data_exporters
+
+
+    @receiver(register_multievent_data_exporters, dispatch_uid="multieventexporter_myexporter")
+    def register_multievent_data_exporter(sender, **kwargs):
+        from .exporter import MyExporter
+        return MyExporter
+
+If your exporter supports both event-level and multi-event level exports, you will need to listen for both
+signals.
 
 The exporter class
 ------------------

doc/development/api/general.rst

@@ -12,7 +12,7 @@ Core
 
 .. automodule:: pretix.base.signals
    :members: periodic_task, event_live_issues, event_copy_data, email_filter, register_notification_types,
-      item_copy_data, register_sales_channels
+      item_copy_data, register_sales_channels, register_global_settings, quota_availability, global_email_filter
 
 Order events
 """"""""""""
@@ -20,17 +20,24 @@ Order events
 There are multiple signals that will be sent out in the ordering cycle:
 
 .. automodule:: pretix.base.signals
-   :members: validate_cart, order_fee_calculation, order_paid, order_placed, order_canceled, order_expired, order_modified, order_changed, order_approved, order_denied, order_fee_type_name, allow_ticket_download
+   :members: validate_cart, validate_cart_addons, validate_order, order_fee_calculation, order_paid, order_placed, order_canceled, order_reactivated, order_expired, order_modified, order_changed, order_approved, order_denied, order_fee_type_name, allow_ticket_download, order_split, order_gracefully_delete, invoice_line_text
+
+Check-ins
+"""""""""
+
+.. automodule:: pretix.base.signals
+   :members: checkin_created
+
 
 Frontend
 --------
 
 .. automodule:: pretix.presale.signals
-   :members: html_head, html_footer, footer_link, front_page_top, front_page_bottom, fee_calculation_for_cart, contact_form_fields, question_form_fields, checkout_confirm_messages, checkout_confirm_page_content, checkout_all_optional, html_page_header, sass_preamble, sass_postamble
+   :members: html_head, html_footer, footer_link, front_page_top, front_page_bottom, front_page_bottom_widget, fee_calculation_for_cart, contact_form_fields, question_form_fields, checkout_confirm_messages, checkout_confirm_page_content, checkout_all_optional, html_page_header, sass_preamble, sass_postamble, render_seating_plan, checkout_flow_steps, position_info, position_info_top, item_description, global_html_head, global_html_footer, global_html_page_header
 
 
 .. automodule:: pretix.presale.signals
-   :members: order_info, order_meta_from_request
+   :members: order_info, order_info_top, order_meta_from_request
 
 Request flow
 """"""""""""
@@ -49,32 +56,35 @@ Backend
 
 .. automodule:: pretix.control.signals
    :members: nav_event, html_head, html_page_start, quota_detail_html, nav_topbar, nav_global, nav_organizer, nav_event_settings,
-             order_info, event_settings_widget, oauth_application_registered, order_position_buttons
-
+             order_info, event_settings_widget, oauth_application_registered, order_position_buttons, subevent_forms,
+             item_formsets, order_search_filter_q
 
 .. automodule:: pretix.base.signals
-   :members: logentry_display, logentry_object_link, requiredaction_display
+   :members: logentry_display, logentry_object_link, requiredaction_display, timeline_events
 
 Vouchers
 """"""""
 
 .. automodule:: pretix.control.signals
-   :members: item_forms
-
-Vouchers
-""""""""
-
-.. automodule:: pretix.control.signals
-   :members: voucher_form_class, voucher_form_html, voucher_form_validation
+   :members: item_forms, voucher_form_class, voucher_form_html, voucher_form_validation
 
 Dashboards
 """"""""""
 
 .. automodule:: pretix.control.signals
-   :members: event_dashboard_widgets, user_dashboard_widgets
+   :members: event_dashboard_widgets, user_dashboard_widgets, event_dashboard_top
 
 Ticket designs
 """"""""""""""
 
 .. automodule:: pretix.base.signals
    :members: layout_text_variables
+
+.. automodule:: pretix.plugins.ticketoutputpdf.signals
+   :members: override_layout
+
+API
+---
+
+.. automodule:: pretix.base.signals
+   :members: validate_event_settings, api_event_settings_fields

doc/development/api/import.rst

@@ -0,0 +1,112 @@
+.. highlight:: python
+   :linenothreshold: 5
+
+.. _`importcol`:
+
+Extending the order import process
+==================================
+
+It's possible through the backend to import orders into pretix, for example from a legacy ticketing system. If your
+plugins defines additional data structures around orders, it might be useful to make it possible to import them as well.
+
+Import process
+--------------
+
+Here's a short description of pretix' import process to show you where the system will need to interact with your plugin.
+You can find more detailed descriptions of the attributes and methods further below.
+
+1. The user uploads a CSV file. The system tries to parse the CSV file and understand its column headers.
+
+2. A preview of the file is shown to the user and the user is asked to assign the various different input parameters to
+   columns of the file or static values. For example, the user either needs to manually select a product or specify a
+   column that contains a product. For this purpose, a select field is rendered for every possible input column,
+   allowing the user to choose between a default/empty value (defined by your ``default_value``/``default_label``)
+   attributes, the columns of the uploaded file, or a static value (defined by your ``static_choices`` method).
+
+3. The user submits its assignment and the system uses the ``resolve`` method of all columns to get the raw value for
+   all columns.
+
+4. The system uses the ``clean`` method of all columns to verify that all input fields are valid and transformed to the
+   correct data type.
+
+5. The system prepares internal model objects (``Order`` etc) and uses the ``assign`` method of all columns to assign
+   these objects with actual values.
+
+6. The system saves all of these model objects to the database in a database transaction. Plugins can create additional
+   objects in this stage through their ``save`` method.
+
+Column registration
+-------------------
+
+The import API does not make a lot of usage from signals, however, it
+does use a signal to get a list of all available import columns. Your plugin
+should listen for this signal and return the subclass of ``pretix.base.orderimport.ImportColumn``
+that we'll provide in this plugin:
+
+.. sourcecode:: python
+
+    from django.dispatch import receiver
+
+    from pretix.base.signals import order_import_columns
+
+
+    @receiver(order_import_columns, dispatch_uid="custom_columns")
+    def register_column(sender, **kwargs):
+        return [
+            EmailColumn(sender),
+        ]
+
+The column class API
+--------------------
+
+.. class:: pretix.base.orderimport.ImportColumn
+
+   The central object of each import extension is the subclass of ``ImportColumn``.
+
+   .. py:attribute:: ImportColumn.event
+
+      The default constructor sets this property to the event we are currently
+      working for.
+
+   .. autoattribute:: identifier
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: verbose_name
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: default_value
+
+   .. autoattribute:: default_label
+
+   .. autoattribute:: initial
+
+   .. automethod:: static_choices
+
+   .. automethod:: resolve
+
+   .. automethod:: clean
+
+   .. automethod:: assign
+
+   .. automethod:: save
+
+Example
+-------
+
+For example, the import column responsible for assigning email addresses looks like this:
+
+.. sourcecode:: python
+
+   class EmailColumn(ImportColumn):
+       identifier = 'email'
+       verbose_name = _('E-mail address')
+
+       def clean(self, value, previous_values):
+           if value:
+               EmailValidator()(value)
+           return value
+
+       def assign(self, value, order, position, invoice_address, **kwargs):
+           order.email = value

doc/development/api/index.rst

@@ -12,8 +12,11 @@ Contents:
    payment
    payment_2.0
    email
+   placeholder
    invoice
    shredder
+   import
    customview
+   auth
    general
    quality

doc/development/api/payment.rst

@@ -62,6 +62,8 @@ The provider class
 
    .. autoattribute:: is_enabled
 
+   .. autoattribute:: priority
+
    .. autoattribute:: settings_form_fields
 
    .. automethod:: settings_form_clean
@@ -108,14 +110,24 @@ The provider class
 
    .. automethod:: execute_refund
 
+   .. automethod:: refund_control_render
+
+   .. automethod:: api_payment_details
+
+   .. automethod:: matching_id
+
    .. automethod:: shred_payment_info
 
+   .. automethod:: cancel_payment
+
    .. autoattribute:: is_implicit
 
    .. autoattribute:: is_meta
 
    .. autoattribute:: test_mode_message
 
+   .. autoattribute:: requires_invoice_immediately
+
 
 Additional views
 ----------------

doc/development/api/placeholder.rst

@@ -0,0 +1,79 @@
+.. highlight:: python
+   :linenothreshold: 5
+
+Writing an e-mail placeholder plugin
+====================================
+
+An email placeholder is a dynamic value that pretix users can use in their email templates.
+
+Please read :ref:`Creating a plugin <pluginsetup>` first, if you haven't already.
+
+Placeholder registration
+------------------------
+
+The placeholder API does not make a lot of usage from signals, however, it
+does use a signal to get a list of all available email placeholders. Your plugin
+should listen for this signal and return an instance of a subclass of ``pretix.base.email.BaseMailTextPlaceholder``::
+
+    from django.dispatch import receiver
+
+    from pretix.base.signals import register_mail_placeholders
+
+
+    @receiver(register_mail_placeholders, dispatch_uid="placeholder_custom")
+    def register_mail_renderers(sender, **kwargs):
+        from .email import MyPlaceholderClass
+        return MyPlaceholder()
+
+
+Context mechanism
+-----------------
+
+Emails are sent in different "contexts" within pretix. For example, many emails are sent in the
+the context of an order, but some are not, such as the notification of a waiting list voucher.
+
+Not all placeholders make sense in every email, and placeholders usually depend some parameters
+themselves, such as the ``Order`` object. Therefore, placeholders are expected to explicitly declare
+what values they depend on and they will only be available in an email if all those dependencies are
+met. Currently, placeholders can depend on the following context parameters:
+
+* ``event``
+* ``order``
+* ``position``
+* ``waiting_list_entry``
+* ``invoice_address``
+* ``payment``
+
+There are a few more that are only to be used internally but not by plugins.
+
+The placeholder class
+---------------------
+
+.. class:: pretix.base.email.BaseMailTextPlaceholder
+
+   .. autoattribute:: identifier
+
+      This is an abstract attribute, you **must** override this!
+
+   .. autoattribute:: required_context
+
+      This is an abstract attribute, you **must** override this!
+
+   .. automethod:: render
+
+      This is an abstract method, you **must** implement this!
+
+   .. automethod:: render_sample
+
+      This is an abstract method, you **must** implement this!
+
+Helper class for simple placeholders
+------------------------------------
+
+pretix ships with a helper class that makes it easy to provide placeholders based on simple
+functions::
+
+     placeholder = SimpleFunctionalMailTextPlaceholder(
+         'code', ['order'], lambda order: order.code, sample='F8VVL'
+     )
+

doc/development/api/plugins.rst

@@ -46,18 +46,25 @@ name               string               The human-readable name of your plugin
 author             string               Your name
 version            string               A human-readable version code of your plugin
 description        string               A more verbose description of what your plugin does.
+category           string               Category of a plugin. Either one of ``"FEATURE"``, ``"PAYMENT"``,
+                                        ``"INTEGRATION"``, ``"CUSTOMIZATION"``, ``"FORMAT"``, or ``"API"``,
+                                        or any other string.
 visible            boolean (optional)   ``True`` by default, can hide a plugin so it cannot be normally activated.
 restricted         boolean (optional)   ``False`` by default, restricts a plugin such that it can only be enabled
                                         for an event by system administrators / superusers.
+compatibility      string               Specifier for compatible pretix versions.
 ================== ==================== ===========================================================
 
 A working example would be::
 
-    from django.apps import AppConfig
-    from django.utils.translation import ugettext_lazy as _
+    try:
+        from pretix.base.plugins import PluginConfig
+    except ImportError:
+        raise RuntimeError("Please use pretix 2.7 or above to run this plugin!")
+    from django.utils.translation import gettext_lazy as _
 
 
-    class PaypalApp(AppConfig):
+    class PaypalApp(PluginConfig):
         name = 'pretix_paypal'
         verbose_name = _("PayPal")
 
@@ -65,9 +72,11 @@ A working example would be::
             name = _("PayPal")
             author = _("the pretix team")
             version = '1.0.0'
+            category = 'PAYMENT
             visible = True
             restricted = False
             description = _("This plugin allows you to receive payments via PayPal")
+            compatibility = "pretix>=2.7.0"
 
 
     default_app_config = 'pretix_paypal.PaypalApp'

doc/development/api/shredder.rst

@@ -35,9 +35,9 @@ The shredder class
 
 .. class:: pretix.base.shredder.BaseDataShredder
 
-   The central object of each invoice renderer is the subclass of ``BaseInvoiceRenderer``.
+   The central object of each data shredder is the subclass of ``BaseDataShredder``.
 
-   .. py:attribute:: BaseInvoiceRenderer.event
+   .. py:attribute:: BaseDataShredder.event
 
       The default constructor sets this property to the event we are currently
       working for.

doc/development/api/ticketoutput.rst

@@ -69,3 +69,13 @@ The output class
    .. automethod:: generate_order
 
    .. autoattribute:: download_button_text
+
+   .. autoattribute:: download_button_icon
+
+   .. autoattribute:: multi_download_button_text
+
+   .. autoattribute:: long_download_button_text
+
+   .. autoattribute:: preview_allowed
+
+   .. autoattribute:: javascript_required

doc/development/contribution/style.rst

@@ -7,7 +7,7 @@ Coding style and quality
   for more information. Use four spaces for indentation.
 
 * We sort our imports by a certain schema, but you don't have to do this by hand. Again, ``setup.cfg`` contains
-  some definitions that allow the command ``isort -rc <directory>`` to automatically sort the imports in your source
+  some definitions that allow the command ``isort <directory>`` to automatically sort the imports in your source
   files.
 
 * For templates and models, please take a look at the `Django Coding Style`_. We like Django's `class-based views`_ and
@@ -18,7 +18,7 @@ Coding style and quality
 * We expect all new code to come with proper tests. When writing new tests, please write them using `pytest-style`_
   test functions and raw ``assert`` statements. Use `fixtures`_ to prevent repetitive code. Some old parts of pretix'
   test suite are in the style of Python's unit test module. If you extend those files, you might continue in this style,
-  but please use pytest style for any new test files.
+  but please use ``pytest`` style for any new test files.
 
 * Please keep the first line of your commit messages short. When referencing an issue, please phrase it like
   ``Fix #123 -- Problems with order creation`` or ``Refs #123 -- Fix this part of that bug``.

doc/development/implementation/logging.rst

@@ -69,7 +69,7 @@ We now need a way to translate the action codes like ``pretix.event.changed`` in
 strings. The :py:attr:`pretix.base.signals.logentry_display` signals allows you to do so. A simple
 implementation could look like::
 
-    from django.utils.translation import ugettext as _
+    from django.utils.translation import gettext as _
     from pretix.base.signals import logentry_display
 
     @receiver(signal=logentry_display)

doc/development/implementation/models.rst

@@ -23,7 +23,7 @@ Organizers and events
    :members:
 
 .. autoclass:: pretix.base.models.Event
-   :members: get_date_from_display, get_time_from_display, get_date_to_display, get_date_range_display, presale_has_ended, presale_is_running, cache, lock, get_plugins, get_mail_backend, payment_term_last, get_payment_providers, get_invoice_renderers, active_subevents, invoice_renderer, settings
+   :members: get_date_from_display, get_time_from_display, get_date_to_display, get_date_range_display, presale_has_ended, presale_is_running, cache, lock, get_plugins, get_mail_backend, payment_term_last, get_payment_providers, get_invoice_renderers, invoice_renderer, settings
 
 .. autoclass:: pretix.base.models.SubEvent
    :members: get_date_from_display, get_time_from_display, get_date_to_display, get_date_range_display, presale_has_ended, presale_is_running

doc/development/setup.rst

@@ -21,10 +21,12 @@ Your should install the following on your system:
 * Python 3.5 or newer
 * ``pip`` for Python 3 (Debian package: ``python3-pip``)
 * ``python-dev`` for Python 3 (Debian package: ``python3-dev``)
+* On Debian/Ubuntu: ``python-venv`` for Python 3 (Debian package: ``python3-venv``)
 * ``libffi`` (Debian package: ``libffi-dev``)
 * ``libssl`` (Debian package: ``libssl-dev``)
 * ``libxml2`` (Debian package ``libxml2-dev``)
 * ``libxslt`` (Debian package ``libxslt1-dev``)
+* ``libenchant1c2a`` (Debian package ``libenchant1c2a``)
 * ``msgfmt`` (Debian package ``gettext``)
 * ``git``
 
@@ -63,9 +65,7 @@ Then, create the local database::
     python manage.py migrate
 
 A first user with username ``admin@localhost`` and password ``admin`` will be automatically
-created. If you want to generate more test data, run::
-
-    python make_testdata.py
+created.
 
 If you want to see pretix in a different language than English, you have to compile our language
 files::
@@ -81,8 +81,7 @@ To run the local development webserver, execute::
 and head to http://localhost:8000/
 
 As we did not implement an overall front page yet, you need to go directly to
-http://localhost:8000/control/ for the admin view or, if you imported the test
-data as suggested above, to the event page at http://localhost:8000/bigevents/2019/
+http://localhost:8000/control/ for the admin view.
 
 .. note:: If you want the development server to listen on a different interface or
           port (for example because you develop on `pretixdroid`_), you can check
@@ -99,7 +98,7 @@ pull request nevertheless and ask us for help, we are happy to assist you.
 Execute the following commands to check for code style errors::
 
     flake8 .
-    isort -c -rc .
+    isort -c .
     python manage.py check
 
 Execute the following command to run pretix' test suite (might take a couple of minutes)::
@@ -122,7 +121,7 @@ for example, to check for any errors in any staged files when committing::
     do
       echo $file
       git show ":$file" | flake8 - --stdin-display-name="$file" || exit 1 # we only want to lint the staged changes, not any un-staged changes
-      git show ":$file" | isort -df --check-only - | grep ERROR && exit 1 || true
+      git show ":$file" | isort -c - | grep ERROR && exit 1 || true
     done
 
 

doc/index.rst

@@ -0,0 +1 @@
+.. include:: contents.rst

doc/plugins/campaigns.rst

@@ -0,0 +1,224 @@
+Campaigns
+=========
+
+The campaigns plugin provides a HTTP API that allows you to create new campaigns.
+
+Resource description
+--------------------
+
+The campaign resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal campaign ID
+code                                  string                     The URL component of the campaign, e.g. with code ``BAR``
+                                                                 the campaign URL would to be ``https://<server>/<organizer>/<event>/c/BAR/``.
+                                                                 This value needs to be *globally unique* and we do not
+                                                                 recommend setting it manually. If you omit it, a random
+                                                                 value will be chosen.
+description                           string                     An internal, human-readable name of the campaign.
+external_target                       string                     An URL to redirect to from the tracking link. To redirect to
+                                                                 the ticket shop, use an empty string.
+order_count                           integer                    Number of orders tracked on this campaign (read-only)
+click_count                           integer                    Number of clicks tracked on this campaign (read-only)
+===================================== ========================== =======================================================
+
+Endpoints
+---------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/campaigns/
+
+   Returns a list of all campaigns configured for an event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/campaigns/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "code": "wZnL11fjq",
+            "description": "Facebook",
+            "external_target": "",
+            "order_count:" 0,
+            "click_count:" 0
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer or event does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/campaigns/(id)/
+
+   Returns information on one campaign, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/campaigns/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "code": "wZnL11fjq",
+        "description": "Facebook",
+        "external_target": "",
+        "order_count:" 0,
+        "click_count:" 0
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the campaign to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/campaign does not exist **or** you have no permission to view it.
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/campaigns/
+
+   Create a new campaign.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/campaigns/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 166
+
+      {
+        "description": "Twitter"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 2,
+        "code": "IfVJQzSBL",
+        "description": "Twitter",
+        "external_target": "",
+        "order_count:" 0,
+        "click_count:" 0
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create a campaign for
+   :param event: The ``slug`` field of the event to create a campaign for
+   :statuscode 201: no error
+   :statuscode 400: The campaign could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to create campaigns.
+
+
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/campaigns/(id)/
+
+   Update a campaign. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/events/sampleconf/campaigns/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 34
+
+      {
+        "external_target": "https://mywebsite.com"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 2,
+        "code": "IfVJQzSBL",
+        "description": "Twitter",
+        "external_target": "https://mywebsite.com",
+        "order_count:" 0,
+        "click_count:" 0
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the campaign to modify
+   :statuscode 200: no error
+   :statuscode 400: The campaign could not be modified due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/campaign does not exist **or** you have no permission to change it.
+
+
+.. http:delete:: /api/v1/organizers/(organizer)/events/(event)/campaigns/(id)/
+
+   Delete a campaign and all associated data.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/events/sampleconf/campaigns/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the campaign to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/campaign does not exist **or** you have no permission to change it

doc/plugins/digital.rst

@@ -0,0 +1,356 @@
+Digital content
+===============
+
+URL interpolation and JWT authentication
+----------------------------------------
+
+In the simplest case, you can use the digital content module to point users to a specific piece of content on some
+platform after their ticket purchase, or show them an embedded video or live stream. However, the full power of the
+module can be utilized by passing additional information to the target system to automatically authenticate the user
+or pre-fill some fields with their data. For example, you could use an URL like this::
+
+    https://webinars.example.com/join?as={attendee_name}&userid={order_code}-{positionid}
+
+While this is already useful, it does not provide much security – anyone could guess a valid combination for that URL.
+Therefore, the module allows you to pass information as a `JSON Web Token`_, which isn't encrypted, but signed with a
+shared secret such that nobody can create their own tokens or modify the contents. To use a token, set up a URL like this::
+
+    https://webinars.example.com/join?with_token={token}
+
+Additionally, you will need to set a JWT secret and a token template, either through the pretix interface or through the
+API (see below). pretix currently only supports tokens signed with ``HMAC-SHA256`` (``HS256``). Your token template can contain
+whatever JSON you'd like to pass on based on the same variables, for example::
+
+    {
+        "iss": "pretix.eu",
+        "aud": "webinars.example.com",
+        "user": {
+            "id": "{order_code}-{positionid}",
+            "product": "{product_id}",
+            "variation": "{variation_id}",
+            "name": "{attendee_name}"
+        }
+    }
+
+Variables can only be used in strings inside the JSON structure.
+pretix will automatically add an ``iat`` claim with the current timestamp and an ``exp`` claim with an expiration timestamp
+based on your configuration.
+
+
+List of variables
+"""""""""""""""""
+
+The following variables are currently supported:
+
+.. rst-class:: rest-resource-table
+
+=================================== ====================================================================
+Variable                            Description
+=================================== ====================================================================
+``order_code``                      Order code (alphanumerical, unique per order, not per ticket)
+``positionid``                      ID of the ticket within the order (integer, starting at 1)
+``order_email``                     E-mail address of the ticket purchaser
+``product_id``                      Internal ID of the purchased product
+``product_variation``               Internal ID of the purchased product variation (or empty)
+``attendee_name``                   Full name of the ticket holder (or empty)
+``attendee_name_*``                 Name parts of the ticket holder, depending on configuration, e.g. ``attendee_name_given_name`` or ``attendee_name_family_name``
+``attendee_email``                  E-mail address of the ticket holder (or empty)
+``attendee_company``                Company of the ticket holder (or empty)
+``attendee_street``                 Street of the ticket holder's address (or empty)
+``attendee_zipcode``                ZIP code of the ticket holder's address (or empty)
+``attendee_city``                   City of the ticket holder's address (or empty)
+``attendee_country``                Country code of the ticket holder's address (or empty)
+``attendee_state``                  State of the ticket holder's address (or empty)
+``answer[XYZ]``                     Answer to the custom question with identifier ``XYZ``
+``invoice_name``                    Full name of the invoice address (or empty)
+``invoice_name_*``                  Name parts of the invoice address, depending on configuration, e.g. ``invoice_name_given_name`` or ``invoice_name_family_name``
+``invoice_company``                 Company of the invoice address (or empty)
+``invoice_street``                  Street of the invoice address (or empty)
+``invoice_zipcode``                 ZIP code of the invoice address (or empty)
+``invoice_city``                    City of the invoice address (or empty)
+``invoice_country``                 Country code of the invoice address (or empty)
+``invoice_state``                   State of the invoice address (or empty)
+``meta_XYZ``                        Value of the event's ``XYZ`` meta property
+``token``                           Signed JWT (only to be used in URLs, not in tokens)
+=================================== ====================================================================
+
+
+API Resource description
+-------------------------
+
+The digital content plugin provides a HTTP API that allows you to create new digital content for your ticket holders,
+such as live streams, videos, or material downloads.
+
+The digital content resource contains the following public fields:
+
+.. rst-class:: rest-resource-table
+
+===================================== ========================== =======================================================
+Field                                 Type                       Description
+===================================== ========================== =======================================================
+id                                    integer                    Internal content ID
+title                                 multi-lingual string       The content title (required)
+content_type                          string                     The type of content, valid values are ``webinar``, ``video``, ``livestream``, ``link``, ``file``
+url                                   string                     The location of the digital content
+description                           multi-lingual string       A public description of the item. May contain Markdown
+                                                                 syntax and is not required.
+available_from                        datetime                   The first date time at which this content will be shown
+                                                                 (or ``null``).
+available_until                       datetime                   The last date time at which this content will b e shown
+                                                                 (or ``null``).
+all_products                          boolean                    If ``true``, the content is available to all buyers of tickets for this event. The ``limit_products`` field is ignored in this case.
+limit_products                        list of integers           List of product/item IDs. This content is only shown to buyers of these ticket types.
+position                              integer                    An integer, used for sorting
+subevent                              integer                    Date in an event series this content should be shown for. Should be ``null`` if this is not an event series or if this should be shown to all customers.
+jwt_template                          string                     Template for JWT token generation
+jwt_secret                            string                     Secret for JWT token generation
+jwt_validity                          integer                    JWT validity in days
+===================================== ========================== =======================================================
+
+API Endpoints
+-------------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/digitalcontents/
+
+   Returns a list of all digital content configured for an event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/digitalcontents/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "count": 1,
+        "next": null,
+        "previous": null,
+        "results": [
+          {
+            "id": 1,
+            "subevent": null,
+            "title": {
+                "en": "Concert livestream"
+            },
+            "content_type": "link",
+            "url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
+            "description": {
+                "en": "Watch our event live here on YouTube!"
+            },
+            "all_products": true,
+            "limit_products": [],
+            "available_from": "2020-03-22T23:00:00Z",
+            "available_until": null,
+            "position": 1
+          }
+        ]
+      }
+
+   :query page: The page number in case of a multi-page result set, default is 1
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer or event does not exist **or** you have no permission to view it.
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/digitalcontents/(id)/
+
+   Returns information on one content item, identified by its ID.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/digitalcontents/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 1,
+        "subevent": null,
+        "title": {
+            "en": "Concert livestream"
+        },
+        "content_type": "link",
+        "url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
+        "description": {
+            "en": "Watch our event live here on YouTube!"
+        },
+        "all_products": true,
+        "limit_products": [],
+        "available_from": "2020-03-22T23:00:00Z",
+        "available_until": null,
+        "position": 1
+      }
+
+   :param organizer: The ``slug`` field of the organizer to fetch
+   :param event: The ``slug`` field of the event to fetch
+   :param id: The ``id`` field of the content to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/content does not exist **or** you have no permission to view it.
+
+.. http:post:: /api/v1/organizers/(organizer)/events/(event)/digitalcontents/
+
+   Create a new digital content.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      POST /api/v1/organizers/bigevents/events/sampleconf/digitalcontents/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 166
+
+      {
+        "subevent": null,
+        "title": {
+            "en": "Concert livestream"
+        },
+        "content_type": "link",
+        "url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
+        "description": {
+            "en": "Watch our event live here on YouTube!"
+        },
+        "all_products": true,
+        "limit_products": [],
+        "available_from": "2020-03-22T23:00:00Z",
+        "available_until": null,
+        "position": 1
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 201 Created
+      Vary: Accept
+      Content-Type: application/json
+
+      {
+        "id": 2,
+        "subevent": null,
+        "title": {
+            "en": "Concert livestream"
+        },
+        "content_type": "link",
+        "url": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
+        "description": {
+            "en": "Watch our event live here on YouTube!"
+        },
+        "all_products": true,
+        "limit_products": [],
+        "available_from": "2020-03-22T23:00:00Z",
+        "available_until": null,
+        "position": 1
+      }
+
+   :param organizer: The ``slug`` field of the organizer to create new content for
+   :param event: The ``slug`` field of the event to create new content for
+   :statuscode 201: no error
+   :statuscode 400: The content could not be created due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event does not exist **or** you have no permission to create digital contents.
+
+
+.. http:patch:: /api/v1/organizers/(organizer)/events/(event)/digitalcontents/(id)/
+
+   Update a content. You can also use ``PUT`` instead of ``PATCH``. With ``PUT``, you have to provide all fields of
+   the resource, other fields will be reset to default. With ``PATCH``, you only need to provide the fields that you
+   want to change.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      PATCH /api/v1/organizers/bigevents/events/sampleconf/digitalcontents/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+      Content-Type: application/json
+      Content-Length: 34
+
+      {
+        "url": "https://mywebsite.com"
+      }
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: text/javascript
+
+      {
+        "id": 2,
+        "subevent": null,
+        "title": {
+            "en": "Concert livestream"
+        },
+        "content_type": "link",
+        "url": "https://mywebsite.com",
+        "description": {
+            "en": "Watch our event live here on YouTube!"
+        },
+        "all_products": true,
+        "limit_products": [],
+        "available_from": "2020-03-22T23:00:00Z",
+        "available_until": null,
+        "position": 1
+      }
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the content to modify
+   :statuscode 200: no error
+   :statuscode 400: The content could not be modified due to invalid submitted data.
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/content does not exist **or** you have no permission to change it.
+
+
+.. http:delete:: /api/v1/organizers/(organizer)/events/(event)/digitalcontents/(id)/
+
+   Delete a digital content.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      DELETE /api/v1/organizers/bigevents/events/sampleconf/digitalcontents/1/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 204 No Content
+      Vary: Accept
+
+   :param organizer: The ``slug`` field of the organizer to modify
+   :param event: The ``slug`` field of the event to modify
+   :param id: The ``id`` field of the content to delete
+   :statuscode 204: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer/event/content does not exist **or** you have no permission to change it
+
+.. _JSON Web Token: https://en.wikipedia.org/wiki/JSON_Web_Token

doc/plugins/index.rst

@@ -14,3 +14,6 @@ If you want to **create** a plugin, please go to the
    banktransfer
    ticketoutputpdf
    badges
+   campaigns
+   digital
+   webinar

doc/plugins/webinar.rst

@@ -0,0 +1,43 @@
+pretix Webinar
+==============
+
+Fetch host URLs
+---------------
+
+.. http:get:: /api/v1/organizers/(organizer)/events/(event)/webinars/
+
+   Returns a list of all currently available webinar calls configured for an event.
+
+   **Example request**:
+
+   .. sourcecode:: http
+
+      GET /api/v1/organizers/bigevents/events/sampleconf/webinars/ HTTP/1.1
+      Host: pretix.eu
+      Accept: application/json, text/javascript
+
+   **Example response**:
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Vary: Accept
+      Content-Type: application/json
+
+      [
+        {
+          "name": "Webinar B – Sept. 8th, 2020",
+          "hosturl": "http://pretix.eu/demo/museum/webinar/host/a9aded3d7bd4df60/30611a34f9fee5d3/"
+        },
+        {
+          "name": "Webinar A – Sept. 8, 2020",
+          "hosturl": "http://pretix.eu/demo/museum/webinar/host/e714x7d4a4a36a04/b9cc444665xxx757/"
+        }
+      ]
+
+   :query subevent: Limit the result to the webinar(s) for a specific subevent.
+   :param organizer: The ``slug`` field of a valid organizer
+   :param event: The ``slug`` field of the event to fetch
+   :statuscode 200: no error
+   :statuscode 401: Authentication failure
+   :statuscode 403: The requested organizer or event does not exist **or** you have no permission to view it.

doc/requirements.txt

@@ -1,8 +1,9 @@
 -r ../src/requirements.txt
-sphinx==1.6.*
+sphinx==2.3.*
 sphinx-rtd-theme
 sphinxcontrib-httpdomain
 sphinxcontrib-images
 sphinxcontrib-spelling
+pygments-markdown-lexer
 # See https://github.com/rfk/pyenchant/pull/130
 git+https://github.com/raphaelm/pyenchant.git@patch-1#egg=pyenchant