post https://{server}/v1/track_usages
This is the method that effectively validate the token, and will return if Total Pass customer should pass trough turnstile.
In "valid" cases, api returns HTTP 204 no content, otherwise api returns HTTP 4** status and their respective motivations.
OBS:
The field "service_provider_code" represents the "gym", so you have to provide the gym code to validate user access.
OBS2:
If the Gym has only one plan, the "service_provider_plan_code" field is optional in payload construction, but when the Gym had more then one plan, the "service_provider_plan_code" field becomes required field.