> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.lettbestilt.no/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.lettbestilt.no/_mcp/server.

# Validate a coupon code

POST https://www.lettbestilt.no/api/v1/coupons/validate
Content-Type: application/json

Checks a code the customer typed against the cart, so you can show the discount before checkout. A well-formed request always gets `200`: read `valid`, and `reason` when it is `false`.

The discount is calculated again when the order is created; send the code as `couponCode` to `POST /orders`. A code replaces automatic promotions: an order gets either a code or the best automatic promotion, never both.

For this endpoint, `slug` goes in the **body**. Rate limit: 30 requests per 60 seconds per slug and IP. Guide: [Coupons and promotions](/coupons).

Reference: https://docs.lettbestilt.no/api-reference/coupons-and-newsletter/validate-coupon

## Authentication

- `Authorization` header (bearer token, required) — Either this or a trusted browser origin. The restaurant's API key, sent as `Authorization: Bearer lbs_…`. Use it from your server only, never in browser code. Keys are issued per restaurant by LettBestilt.
- `Origin` header (required) — Either this or an API key. No key is needed when the request's `Origin` header is trusted for this restaurant: `https://{slug}.lettbestilt.no`, a verified domain of the restaurant, or a partner origin LettBestilt has bound to the restaurant. Browsers set `Origin` themselves; it is not something you configure. Not accepted by `GET /site-gate`, which requires an API key.

## Request

### Body (application/json)

This endpoint expects an object.

- `slug` (string, required) — The restaurant's slug. Sent in the body for this endpoint.
- `code` (string, required) — The code the customer typed. Not case-sensitive.
- `subtotal` (integer, required) — The cart subtotal in øre, including add-ons.
- `fulfillment` (enum, optional) — Optional. Pass to evaluate `WRONG_FULFILLMENT` correctly when the coupon is restricted to one fulfillment type.
  - Allowed values: `PICKUP`, `DELIVERY`
- `deliveryFee` (integer, optional) — Optional. Delivery fee in øre — needed to evaluate FREE_DELIVERY coupons correctly.
- `cart` (list of ApiV1CouponsValidatePostRequestBodyContentApplicationJsonSchemaCartItems, optional) — Optional for validate (unlike preview-auto, where it's required). Pass it when the coupon is scoped to specific products/categories, uses per-variant FIXED_PRICE pricing, or is a BUNDLE («X for Y kr») offer, so `NOT_APPLICABLE_TO_CART` can be evaluated correctly. A BUNDLE code without a cart is always `NOT_APPLICABLE_TO_CART`.
- `email` (string, optional) — Optional. Required when the coupon is only for newsletter subscribers; without it the response is `reason: SUBSCRIBER_ONLY`. It also lets the server check once-per-customer codes early.
- `requestedPickupAt` (datetime, optional) — Optional. The pickup time the customer selected for a pre-order (same value you send as `requestedPickupAt` to `POST /api/v1/orders`). Day-of-week and time-of-day restrictions on the coupon (and its expiry) are evaluated against THIS moment, not the moment of the request — a Monday/Tuesday offer must not apply to an order placed on Tuesday for a Thursday pickup. Omit for as-soon-as-possible orders. Send the same value here and on the order, or the cart will show a discount the order rejects.

## Response

### 200

The result. Always `200` when the request is valid, also when the code does not apply: then `valid` is `false` and `reason` says why.

- `Coupons and newsletter_validateCoupon_Response_200`

## Errors

### 401 Unauthorized Error

`UNAUTHORIZED`: missing or invalid API key, and the request does not come from a trusted browser origin.

- `error` (ErrorBody, required)

### 404 Not Found Error

`RESTAURANT_NOT_FOUND`: no live restaurant has this slug.

- `error` (ErrorBody, required)

### 422 Unprocessable Entity Error

`VALIDATION_FAILED`: the body failed validation. `error.details.issues` lists the fields.

- `error` (ErrorBody, required)

### 429 Too Many Requests Error

`RATE_LIMITED`: more than 30 requests in 60 seconds for this slug and IP.

- `error` (ErrorBody, required)

## Types

### ApiV1CouponsValidatePostRequestBodyContentApplicationJsonSchemaCartItems

- `productId` (string, required)
- `categoryId` (string, required)
- `lineTotal` (integer, required) — Unit price × quantity in øre, incl. addons.
- `quantity` (integer, optional) — Number of units on the line. Counts units for `BUNDLE` offers ("X for Y kr").
- `variantName` (string, optional, nullable) — Required for `FIXED_PRICE` promotions with prices per variant (for example `Medium` or `Stor`). Also used for `BUNDLE` offers limited to one size.

### CouponsAndNewsletterValidateCouponResponse2000

- `valid` (any, optional)
- `discount` (integer, optional) — The discount in øre.
- `coupon` (ValidatedCoupon, optional)

### CouponsAndNewsletterValidateCouponResponse2001

- `valid` (any, optional)
- `discount` (any, optional)
- `reason` (enum, optional) — Why the code does not apply. `NOT_APPLICABLE_TO_CART` is also returned when an "X for Y kr" (`BUNDLE`) offer has too few qualifying items in the cart.
  - Allowed values: `UNKNOWN_OR_INACTIVE`, `NOT_YET_VALID`, `EXPIRED`, `EXHAUSTED`, `MINIMUM_NOT_MET`, `WRONG_DAY`, `WRONG_TIME`, `WRONG_FULFILLMENT`, `NOT_APPLICABLE_TO_CART`, `SUBSCRIBER_ONLY`, `ALREADY_REDEEMED`
- `message` (string, optional) — A ready-made Norwegian explanation you can show the customer as it is (added October 2026). For `BUNDLE` it tells "requires at least N items" apart from "does not give a lower price", which both have `reason: NOT_APPLICABLE_TO_CART`.

### ErrorBody

- `code` (enum, required) — A machine-readable error code.
  - Allowed values: `MISSING_SLUG`, `MISSING_TOKEN`, `INVALID_JSON`, `INVALID_SUCCESS_URL`, `INVALID_CANCEL_URL`, `VALIDATION_FAILED`, `RESTAURANT_NOT_FOUND`, `ORDER_NOT_FOUND`, `RATE_LIMITED`, `BAD_REQUEST`, `UNAUTHORIZED`, `FORBIDDEN`, `POPUP_NOT_AVAILABLE`, `PRICE_CHANGED`, `PAYMENT_INCOMPLETE`, `PAYMENT_PENDING`, `PAYMENT_PROVIDER_INVALID`, `FULFILLMENT_NOT_ALLOWED`, `IDEMPOTENCY_CONFLICT`, `DINE_IN_DISABLED`, `PARTY_TOO_LARGE`, `TOO_EARLY`, `INTERNAL_ERROR`
- `message` (string, required) — A human-readable explanation. Often in Norwegian, and for business rules usually suitable to show the customer.
- `details` (any, optional) — Extra data for some codes, for example `issues` for `VALIDATION_FAILED` or the totals for `PRICE_CHANGED`.

### ValidatedCoupon

- `code` (string, optional)
- `description` (string, optional, nullable)
- `displayName` (string, optional, nullable)
- `discountType` (enum, optional) — Treat unknown values as a general offer.
  - Allowed values: `PERCENT`, `FIXED`, `FIXED_PRICE`, `FREE_DELIVERY`, `BUNDLE`
- `discountValue` (integer, optional) — `PERCENT`: percent. `FIXED` and `FIXED_PRICE`: øre. `BUNDLE`: the price in øre for one bundle of `bundleQuantity` units, not the discount. Show `discount`.
- `minimumOrder` (integer, optional) — Minimum subtotal in øre.
- `appliesTo` (enum, optional)
  - Allowed values: `ORDER`, `CATEGORIES`, `PRODUCTS`
- `bundleQuantity` (integer, optional, nullable) — `BUNDLE` only: units per bundle.
- `bundleTierKey` (string, optional, nullable) — `BUNDLE` only: only variants with this `addonTierKey` count.
- `maxBundlesPerOrder` (integer, optional, nullable) — `BUNDLE` only: the maximum number of bundles per order.

## Examples

**Request**

```json
{
  "slug": "pizzaroma",
  "code": "VELKOMMEN",
  "subtotal": 33800,
  "fulfillment": "PICKUP",
  "cart": [
    {
      "productId": "cm1pza0001margherita",
      "categoryId": "cm1cat0001pizza",
      "lineTotal": 33800,
      "quantity": 2,
      "variantName": "Medium"
    }
  ],
  "email": "kari@example.com"
}
```

**Response**

```json
{
  "coupon": {
    "appliesTo": "ORDER",
    "bundleQuantity": null,
    "bundleTierKey": null,
    "code": "VELKOMMEN",
    "description": "50 kr off your first order",
    "discountType": "FIXED",
    "discountValue": 5000,
    "displayName": "Velkomstrabatt",
    "maxBundlesPerOrder": null,
    "minimumOrder": 20000
  },
  "discount": 5000,
  "valid": null
}
```

**SDK Code**

```python Coupons and newsletter_validateCoupon_example
import requests

url = "https://www.lettbestilt.no/api/v1/coupons/validate"

payload = {
    "slug": "pizzaroma",
    "code": "VELKOMMEN",
    "subtotal": 33800,
    "fulfillment": "PICKUP",
    "cart": [
        {
            "productId": "cm1pza0001margherita",
            "categoryId": "cm1cat0001pizza",
            "lineTotal": 33800,
            "quantity": 2,
            "variantName": "Medium"
        }
    ],
    "email": "kari@example.com"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript Coupons and newsletter_validateCoupon_example
const url = 'https://www.lettbestilt.no/api/v1/coupons/validate';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"slug":"pizzaroma","code":"VELKOMMEN","subtotal":33800,"fulfillment":"PICKUP","cart":[{"productId":"cm1pza0001margherita","categoryId":"cm1cat0001pizza","lineTotal":33800,"quantity":2,"variantName":"Medium"}],"email":"kari@example.com"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Coupons and newsletter_validateCoupon_example
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://www.lettbestilt.no/api/v1/coupons/validate"

	payload := strings.NewReader("{\n  \"slug\": \"pizzaroma\",\n  \"code\": \"VELKOMMEN\",\n  \"subtotal\": 33800,\n  \"fulfillment\": \"PICKUP\",\n  \"cart\": [\n    {\n      \"productId\": \"cm1pza0001margherita\",\n      \"categoryId\": \"cm1cat0001pizza\",\n      \"lineTotal\": 33800,\n      \"quantity\": 2,\n      \"variantName\": \"Medium\"\n    }\n  ],\n  \"email\": \"kari@example.com\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Coupons and newsletter_validateCoupon_example
require 'uri'
require 'net/http'

url = URI("https://www.lettbestilt.no/api/v1/coupons/validate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"slug\": \"pizzaroma\",\n  \"code\": \"VELKOMMEN\",\n  \"subtotal\": 33800,\n  \"fulfillment\": \"PICKUP\",\n  \"cart\": [\n    {\n      \"productId\": \"cm1pza0001margherita\",\n      \"categoryId\": \"cm1cat0001pizza\",\n      \"lineTotal\": 33800,\n      \"quantity\": 2,\n      \"variantName\": \"Medium\"\n    }\n  ],\n  \"email\": \"kari@example.com\"\n}"

response = http.request(request)
puts response.read_body
```

```java Coupons and newsletter_validateCoupon_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://www.lettbestilt.no/api/v1/coupons/validate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"slug\": \"pizzaroma\",\n  \"code\": \"VELKOMMEN\",\n  \"subtotal\": 33800,\n  \"fulfillment\": \"PICKUP\",\n  \"cart\": [\n    {\n      \"productId\": \"cm1pza0001margherita\",\n      \"categoryId\": \"cm1cat0001pizza\",\n      \"lineTotal\": 33800,\n      \"quantity\": 2,\n      \"variantName\": \"Medium\"\n    }\n  ],\n  \"email\": \"kari@example.com\"\n}")
  .asString();
```

```php Coupons and newsletter_validateCoupon_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://www.lettbestilt.no/api/v1/coupons/validate', [
  'body' => '{
  "slug": "pizzaroma",
  "code": "VELKOMMEN",
  "subtotal": 33800,
  "fulfillment": "PICKUP",
  "cart": [
    {
      "productId": "cm1pza0001margherita",
      "categoryId": "cm1cat0001pizza",
      "lineTotal": 33800,
      "quantity": 2,
      "variantName": "Medium"
    }
  ],
  "email": "kari@example.com"
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Coupons and newsletter_validateCoupon_example
using RestSharp;

var client = new RestClient("https://www.lettbestilt.no/api/v1/coupons/validate");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"slug\": \"pizzaroma\",\n  \"code\": \"VELKOMMEN\",\n  \"subtotal\": 33800,\n  \"fulfillment\": \"PICKUP\",\n  \"cart\": [\n    {\n      \"productId\": \"cm1pza0001margherita\",\n      \"categoryId\": \"cm1cat0001pizza\",\n      \"lineTotal\": 33800,\n      \"quantity\": 2,\n      \"variantName\": \"Medium\"\n    }\n  ],\n  \"email\": \"kari@example.com\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Coupons and newsletter_validateCoupon_example
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = [
  "slug": "pizzaroma",
  "code": "VELKOMMEN",
  "subtotal": 33800,
  "fulfillment": "PICKUP",
  "cart": [
    [
      "productId": "cm1pza0001margherita",
      "categoryId": "cm1cat0001pizza",
      "lineTotal": 33800,
      "quantity": 2,
      "variantName": "Medium"
    ]
  ],
  "email": "kari@example.com"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://www.lettbestilt.no/api/v1/coupons/validate")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```