Endpoint reference
All 92 routes, grouped by the prefix that guards them.
Every route below already includes the /api context path. Paths are grouped by prefix because
the prefix is the access rule — each one is guarded by a path-matched interceptor, so a route
added under it later is protected by its URL rather than by someone remembering an annotation.
These tables are generated against the controllers and say what each route is for. They do not
carry request and response schemas: those live in pass-service/api-tracker/, which is the
contract of record and stays accurate in a way a hand-written mirror would not.
/api/partner
2 routes — a merchant's booking system
/api/dashboard
45 routes — the merchant web dashboard
/api/scan
9 routes — the staff scanner app
/api/public
10 routes — no session required
/api/apple, /api/admin
26 routes — wallets and platform staff
Credentials at a glance
| Surface | Credential | Missing | Wrong role |
|---|---|---|---|
/api/partner | Authorization: Bearer <tenant key> | 401 | — |
/api/dashboard | Session cookie | 401 | 403 unless OWNER/MANAGER |
/api/scan | Session cookie from a paired device | 401 | any role admitted |
/api/public | none, or an unguessable id + ?t= token | 404 | — |
/api/apple/v1 | Authorization: ApplePass <token> | 401 | — |
/api/admin | Platform admin session | 401 | — |
A scanner-credential session reaching /api/dashboard is a 403, even for an OWNER: a paired
till phone is a durable secret sitting on a counter, and the dashboard gate checks the credential
as well as the role.
Status codes
| 200 | Success, including idempotent writes that changed nothing |
| 201 | A genuinely new resource. Note enrollment and partner issuance answer 200, not 201 |
| 202 | Accepted — notice sends, which queue |
| 204 | Deletes and logouts |
| 400 | Validation or a domain rule. Carries errors[] |
| 401 | No session, or a bad credential |
| 403 | Signed in, but not here |
| 404 | Not found — also the answer for a wrong pass token, deliberately |
| 409 | A conflict: already redeemed, already claimed, not published, slug taken |
Pagination
Two lists paginate, both with the same shape: page (0-based, default 0) and size (default
20, 1–100, outside that a 400). Everything else returns a plain array.
GET /api/dashboard/customersGET /api/dashboard/programs/{programId}/notices