# Open Mercato API Version: 0.7.0 Auto-generated OpenAPI definition for all enabled modules. ## Servers - https://server.tail3470ec.ts.net/api – Default environment ## GET `/audit_logs/audit-logs/access` Retrieve access logs Fetches paginated access audit logs scoped to the authenticated user. Tenant administrators can optionally expand the search to other actors or organizations. **Tags:** Audit & Action Logs **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | organizationId | query | any | Optional. Limit results to a specific organization | | actorUserId | query | any | Optional. Filter by actor user id (tenant administrators only) | | resourceKind | query | any | Optional. Restrict to a resource kind such as `order` or `product` | | accessType | query | any | Optional. Access type filter, e.g. `read` or `export` | | page | query | any | Optional. Page number (default 1) | | pageSize | query | any | Optional. Page size (default 50) | | limit | query | any | Optional. Explicit maximum number of records when paginating manually | | before | query | any | Optional. Return logs created before this ISO-8601 timestamp | | after | query | any | Optional. Return logs created after this ISO-8601 timestamp | ### Responses **200** – Access logs returned successfully Content-Type: `application/json` ```json { "items": [ { "id": "string", "resourceKind": "string", "resourceId": "string", "accessType": "string", "actorUserId": null, "actorUserName": null, "tenantId": null, "tenantName": null, "organizationId": null, "organizationName": null, "fields": [ "string" ], "context": null, "createdAt": "string" } ], "canViewTenant": true, "page": 1, "pageSize": 1, "total": 1, "totalPages": 1 } ``` **400** – Invalid filters supplied Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Caller has no resolved tenant scope and is not a superadmin Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/audit_logs/audit-logs/access" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/audit_logs/audit-logs/actions` Fetch action logs Returns recent action audit log entries. Tenant administrators can widen the scope to other actors or organizations, and callers can optionally restrict results to undoable actions. **Tags:** Audit & Action Logs **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | organizationId | query | any | Optional. Limit results to a specific organization | | actorUserId | query | any | Optional. Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list. | | resourceKind | query | any | Optional. Filter by resource kind (e.g., "order", "product") | | resourceId | query | any | Optional. Filter by resource ID (UUID of the specific record) | | actionType | query | any | Optional. Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list. | | fieldName | query | any | Optional. Filter to entries where the given field changed. Accepts a single field name or a comma-separated list. | | includeRelated | query | any | Optional. When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId | | includeTotal | query | any | Optional. When `true`, the response includes the filtered total count. | | undoableOnly | query | any | Optional. When `true`, only undoable actions are returned | | limit | query | any | Optional. Maximum number of records to return (default 50, max 1000) | | offset | query | any | Optional. Zero-based record offset for pagination (legacy — prefer page/pageSize) | | page | query | any | Optional. Page number (default 1) | | pageSize | query | any | Optional. Page size (default 50, max 200) | | sortField | query | any | Optional. Sort field: `createdAt`, `user`, `action`, `field`, or `source`. | | sortDir | query | any | Optional. Sort direction: `asc` or `desc`. | | before | query | any | Optional. Return actions created before this ISO-8601 timestamp | | after | query | any | Optional. Return actions created after this ISO-8601 timestamp | ### Responses **200** – Action logs retrieved successfully Content-Type: `application/json` ```json { "items": [ { "id": "string", "commandId": "string", "actionLabel": null, "executionState": "done", "actorUserId": null, "actorUserName": null, "tenantId": null, "tenantName": null, "organizationId": null, "organizationName": null, "resourceKind": null, "resourceId": null, "parentResourceKind": null, "parentResourceId": null, "undoToken": null, "createdAt": "string", "updatedAt": "string", "snapshotBefore": null, "snapshotAfter": null, "changes": null, "context": null } ], "canViewTenant": true, "page": 1, "pageSize": 1, "total": 1, "totalPages": 1 } ``` **400** – Invalid filter values Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Caller has no resolved tenant scope and is not a superadmin Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/audit_logs/audit-logs/actions?includeRelated=false&includeTotal=false&undoableOnly=false" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/audit_logs/audit-logs/actions/export` Export action logs as CSV Returns a CSV attachment containing filtered action audit log entries. Tenant administrators can widen the scope to other actors or organizations. **Tags:** Audit & Action Logs **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | organizationId | query | any | Optional. Limit results to a specific organization | | actorUserId | query | any | Optional. Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list. | | resourceKind | query | any | Optional. Filter by resource kind (e.g., "order", "product") | | resourceId | query | any | Optional. Filter by resource ID (UUID of the specific record) | | actionType | query | any | Optional. Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list. | | fieldName | query | any | Optional. Filter to entries where the given field changed. Accepts a single field name or a comma-separated list. | | includeRelated | query | any | Optional. When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId | | undoableOnly | query | any | Optional. When `true`, only undoable actions are returned | | limit | query | any | Optional. Maximum number of records to export (default 1000, capped at 1000) | | sortField | query | any | Optional. Sort field: `createdAt`, `user`, `action`, `field`, or `source`. | | sortDir | query | any | Optional. Sort direction: `asc` or `desc`. | | before | query | any | Optional. Return actions created before this ISO-8601 timestamp | | after | query | any | Optional. Return actions created after this ISO-8601 timestamp | ### Responses **200** – CSV export generated successfully Content-Type: `application/json` ```json { "file": "csv" } ``` **400** – Invalid filter values Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Caller has no resolved tenant scope and is not a superadmin Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/audit_logs/audit-logs/actions/export?includeRelated=false&undoableOnly=false" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/audit_logs/audit-logs/actions/redo` Redo by action log id Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope. **Tags:** Audit & Action Logs **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "logId": "string" } ``` ### Responses **200** – Redo executed successfully Content-Type: `application/json` ```json { "ok": true, "logId": null, "undoToken": null } ``` **400** – Log not eligible for redo Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Redo blocked by scope checks Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/audit_logs/audit-logs/actions/redo" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"logId\": \"string\" }" ``` ## POST `/audit_logs/audit-logs/actions/undo` Undo action by token Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller. **Tags:** Audit & Action Logs **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "undoToken": "string" } ``` ### Responses **200** – Undo applied successfully Content-Type: `application/json` ```json { "ok": true, "logId": "string" } ``` **400** – Invalid or unavailable undo token Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Undo blocked by organization or tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` **422** – Undo deliberately blocked by a beforeUndo command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body. Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/audit_logs/audit-logs/actions/undo" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"undoToken\": \"string\" }" ``` ## GET `/auth/admin/nav` Resolve backend chrome bootstrap payload Returns the backend chrome payload available to the authenticated administrator after applying scope, RBAC, role defaults, and personal sidebar preferences. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Backend chrome payload Content-Type: `application/json` ```json { "brand": null, "groups": [ { "name": "string", "items": [ { "href": "string", "title": "string" } ] } ], "settingsSections": [ { "id": "string", "label": "string", "items": [ { "id": "string", "label": "string", "href": "string" } ] } ], "settingsPathPrefixes": [ "string" ], "profileSections": [ { "id": "string", "label": "string", "items": [ { "id": "string", "label": "string", "href": "string" } ] } ], "profilePathPrefixes": [ "string" ], "grantedFeatures": [ "string" ], "roles": [ "string" ], "currentOrganization": null } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/admin/nav" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/autologin` Auto sign-in using env-configured demo credentials When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured. **Tags:** Authentication & Accounts ### Responses **200** – Success response Content-Type: `application/json` **307** – Redirect into the app (or to /login on failure) Content-Type: `text/html` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/autologin" \ -H "Accept: application/json" ``` ## POST `/auth/feature-check` Check feature grants for the current user Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "features": [ "string" ] } ``` ### Responses **200** – Evaluation result Content-Type: `application/json` ```json { "ok": true, "granted": [ "string" ], "userId": "string" } ``` **400** – Invalid request — features array missing, too large, or contains invalid entries Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/feature-check" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"features\": [ \"string\" ] }" ``` ## GET `/auth/features` List declared feature flags Returns all static features contributed by the enabled modules along with their module source. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Aggregated feature catalog Content-Type: `application/json` ```json { "items": [ { "id": "string", "title": "string", "module": "string" } ], "modules": [ { "id": "string", "title": "string" } ] } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/features" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/locale` Set locale and redirect Stores the selected locale in a cookie and redirects to a safe local path. **Tags:** Authentication & Accounts ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | locale | query | any | Required | | redirect | query | any | Optional | ### Responses **200** – Success response Content-Type: `application/json` **302** – Locale cookie set and request redirected Content-Type: `application/json` **400** – Invalid locale Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/locale?locale=en" \ -H "Accept: application/json" ``` ## POST `/auth/locale` Set locale Stores the selected locale in a cookie and returns a JSON success response. **Tags:** Authentication & Accounts ### Request Body Content-Type: `application/json` ```json { "locale": "en" } ``` ### Responses **200** – Locale cookie set Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid locale or malformed request body Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/locale" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d "{ \"locale\": \"en\" }" ``` ## POST `/auth/login` Authenticate user credentials Validates the submitted credentials and issues a bearer token cookie for subsequent API calls. **Tags:** Authentication & Accounts ### Request Body Content-Type: `application/x-www-form-urlencoded` ```text email=user%40example.com&password=string ``` ### Responses **200** – Authentication succeeded Content-Type: `application/json` ```json { "ok": true, "token": "string", "redirect": null } ``` **400** – Validation failed Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **401** – Invalid credentials Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **403** – User lacks required role Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **429** – Too many login attempts Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/login" \ -H "Accept: application/json" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "email=user%40example.com&password=string" ``` ## POST `/auth/logout` Invalidate session and redirect Clears authentication cookies and redirects the browser to the login page. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **201** – Success response Content-Type: `application/json` **302** – Redirect to login after successful logout Content-Type: `text/html` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/logout" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/profile` Get current profile Returns the email address, display name, and roles for the signed-in user. The display name is null when unset. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Profile payload Content-Type: `application/json` ```json { "email": "user@example.com", "name": null, "roles": [ "string" ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – User not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/profile" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/auth/profile` Update current profile Updates the email address or password for the signed-in user. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Profile updated Content-Type: `application/json` ```json { "ok": true, "email": "user@example.com" } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/profile" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/auth/reset` Send reset email Requests a password reset email for the given account. The endpoint always returns `ok: true` to avoid leaking account existence. **Tags:** Authentication & Accounts ### Request Body Content-Type: `application/x-www-form-urlencoded` ```text email=user%40example.com ``` ### Responses **200** – Reset email dispatched (or ignored for unknown accounts) Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid request origin Content-Type: `application/json` ```json { "error": "string" } ``` **429** – Too many password reset requests Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Password reset email origin is not configured Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/reset" \ -H "Accept: application/json" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "email=user%40example.com" ``` ## POST `/auth/reset/confirm` Complete password reset Validates the reset token and updates the user password. **Tags:** Authentication & Accounts ### Request Body Content-Type: `application/x-www-form-urlencoded` ```text token=string&password=string ``` ### Responses **200** – Password reset succeeded Content-Type: `application/json` ```json { "ok": true, "redirect": "string" } ``` **400** – Invalid token or payload Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **429** – Too many reset confirmation attempts Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/reset/confirm" \ -H "Accept: application/json" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "token=string&password=string" ``` ## DELETE `/auth/roles` Delete role Deletes a role by identifier. Fails when users remain assigned. **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Required. Role identifier | ### Responses **200** – Role deleted Content-Type: `application/json` ```json { "ok": true } ``` **400** – Role cannot be deleted Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/auth/roles?id=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/roles` List roles Returns available roles within the current tenant. Super administrators receive visibility across tenants. **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | search | query | any | Optional | | tenantId | query | any | Optional | ### Responses **200** – Role collection Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "usersCount": 1, "tenantId": null, "tenantName": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/roles?page=1&pageSize=50" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/auth/roles` Create role Creates a new role anchored to the caller's tenant. Non-superadmins cannot target another tenant; supplying a foreign `tenantId` is rejected. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string" } ``` ### Responses **201** – Role created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/roles" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\" }" ``` ## PUT `/auth/roles` Update role Updates mutable fields on an existing role. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Role updated Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/roles" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/auth/roles/acl` Fetch role ACL Returns the feature and organization assignments associated with a role within the current tenant. **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | roleId | query | any | Required | | tenantId | query | any | Optional | ### Responses **200** – Role ACL entry Content-Type: `application/json` ```json { "isSuperAdmin": true, "features": [ "string" ], "organizations": null, "updatedAt": null } ``` **400** – Invalid role id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/roles/acl?roleId=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/auth/roles/acl` Update role ACL Replaces the feature list, super admin flag, and optional organization assignments for a role. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "roleId": "00000000-0000-4000-8000-000000000000", "organizations": null } ``` ### Responses **200** – Role ACL updated Content-Type: `application/json` ```json { "ok": true, "sanitized": true } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient privileges to modify ACL Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/roles/acl" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"roleId\": \"00000000-0000-4000-8000-000000000000\", \"organizations\": null }" ``` ## GET `/auth/session/refresh` Refresh auth cookie from session token (browser) Exchanges an existing `session_token` cookie for a fresh JWT auth cookie and redirects the browser. **Tags:** Authentication & Accounts ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | redirect | query | any | Optional. Absolute or relative URL to redirect after refresh | ### Responses **200** – Success response Content-Type: `application/json` **302** – Redirect to target location when session is valid Content-Type: `text/html` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/session/refresh" \ -H "Accept: application/json" ``` ## POST `/auth/session/refresh` Refresh access token (API/mobile) Exchanges a refresh token for a new JWT access token. Pass the refresh token obtained from login in the request body. **Tags:** Authentication & Accounts ### Request Body Content-Type: `application/json` ```json { "refreshToken": "string" } ``` ### Responses **200** – New access token issued Content-Type: `application/json` ```json { "ok": true, "accessToken": "string", "expiresIn": 1 } ``` **400** – Missing refresh token Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **401** – Invalid or expired token Content-Type: `application/json` ```json { "ok": false, "error": "string" } ``` **429** – Too many refresh attempts Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/session/refresh" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d "{ \"refreshToken\": \"string\" }" ``` ## DELETE `/auth/sidebar/preferences` Delete a role sidebar variant Removes the role variant for the current tenant + locale. Idempotent. Requires `auth.sidebar.manage`. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Variant deleted (or never existed) Content-Type: `application/json` ```json { "ok": true, "scope": { "type": "user" } } ``` **400** – Missing roleId query parameter Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing features Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found in current tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/auth/sidebar/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/sidebar/preferences` Get sidebar preferences Returns sidebar customization for the current user (default) or the specified role (`?roleId=…`, requires `auth.sidebar.manage`). **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Current sidebar configuration Content-Type: `application/json` ```json { "locale": "string", "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "canApplyToRoles": true, "roles": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "hasPreference": true } ], "scope": { "type": "user" }, "updatedAt": null } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing features for role-scope read Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found in current tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/sidebar/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/auth/sidebar/preferences` Update sidebar preferences Updates sidebar configuration. With `scope.type === "user"` (default) writes the calling user's personal preferences and may optionally apply the same settings to selected roles via `applyToRoles[]`. With `scope.type === "role"` writes the named role variant directly (requires `auth.sidebar.manage`); `applyToRoles[]` and `clearRoleIds[]` are rejected in this mode. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Preferences saved Content-Type: `application/json` ```json { "locale": "string", "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "canApplyToRoles": true, "roles": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "hasPreference": true } ], "scope": { "type": "user" }, "updatedAt": null, "appliedRoles": [ "00000000-0000-4000-8000-000000000000" ], "clearedRoles": [ "00000000-0000-4000-8000-000000000000" ] } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing features for role-wide updates Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Role not found in current tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/sidebar/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## GET `/auth/sidebar/variants` List sidebar variants Returns the named sidebar variants saved by the current user for the current tenant + locale. **Tags:** Authentication & Accounts **Requires authentication.** ### Responses **200** – Variant list Content-Type: `application/json` ```json { "locale": "string", "variants": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true, "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "createdAt": "string", "updatedAt": null } ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/sidebar/variants" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/auth/sidebar/variants` Create a sidebar variant Creates a new variant. If `name` is omitted or blank, an auto-name like "My preferences", "My preferences 2", … is assigned. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Variant created Content-Type: `application/json` ```json { "locale": "string", "variant": { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true, "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "createdAt": "string", "updatedAt": null } } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/sidebar/variants" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## DELETE `/auth/sidebar/variants/{id}` Delete a sidebar variant Soft-deletes the variant (sets deleted_at). **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Variant deleted Content-Type: `application/json` ```json { "ok": true } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Variant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/auth/sidebar/variants/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/sidebar/variants/{id}` Get a sidebar variant **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Variant Content-Type: `application/json` ```json { "locale": "string", "variant": { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true, "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "createdAt": "string", "updatedAt": null } } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Variant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/sidebar/variants/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/auth/sidebar/variants/{id}` Update a sidebar variant Updates the variant's name, settings, and/or isActive flag. Setting `isActive: true` deactivates other variants in the same scope (only one active per user/tenant/locale). **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Variant updated Content-Type: `application/json` ```json { "locale": "string", "variant": { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true, "settings": { "version": 1, "groupOrder": [ "string" ], "groupLabels": { "key": "string" }, "itemLabels": { "key": "string" }, "hiddenItems": [ "string" ], "itemOrder": { "key": [ "string" ] } }, "createdAt": "string", "updatedAt": null } } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Variant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/sidebar/variants/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## DELETE `/auth/users` Delete user Deletes a user by identifier. Rejected when the target is the last active holder of a protected role in the tenant. Undo support is provided via the command bus. **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Required. User identifier | ### Responses **200** – User deleted Content-Type: `application/json` ```json { "ok": true } ``` **400** – User cannot be deleted, or is the last active holder of a protected role Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – User not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/auth/users?id=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/auth/users` List users Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller's active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record). **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | search | query | any | Optional | | name | query | any | Optional | | organizationId | query | any | Optional | | scopeToActiveOrganization | query | any | Optional | | roleIds | query | any | Optional | ### Responses **200** – User collection Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "email": "user@example.com", "name": null, "organizationId": null, "organizationName": null, "tenantId": null, "tenantName": null, "roles": [ "string" ], "isConfirmed": true, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/users?page=1&pageSize=50" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/auth/users` Create user Creates a new confirmed user within the specified organization, optional display name, and optional roles. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "email": "user@example.com", "name": null, "organizationId": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **201** – User created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Invalid payload or duplicate email Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Attempted to assign privileged roles Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/users" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"email\": \"user@example.com\", \"name\": null, \"organizationId\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## PUT `/auth/users` Update user Updates profile fields including display name, organization assignment, credentials, or role memberships. A destination organization must be within the caller's descendant-expanded organization scope. Retained and newly assigned roles must belong to the destination tenant and be grantable by the caller. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role's minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "name": null } ``` ### Responses **200** – User updated Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid payload, duplicate email, or the update would remove the last active holder of a protected role Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Destination organization is outside caller scope, or a retained or assigned role is not grantable Content-Type: `application/json` ```json { "error": "string" } ``` **404** – User or destination organization not found in the caller tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/users" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\", \"name\": null }" ``` ## GET `/auth/users/acl` Fetch user ACL Returns custom ACL overrides for a user within the current tenant, if any. **Tags:** Authentication & Accounts **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | userId | query | any | Required | ### Responses **200** – User ACL entry Content-Type: `application/json` ```json { "hasCustomAcl": true, "isSuperAdmin": true, "features": [ "string" ], "organizations": null, "updatedAt": null } ``` **400** – Invalid user id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/users/acl?userId=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/auth/users/acl` Update user ACL Updates a per-user ACL override. Omitted super admin, feature, and organization fields preserve their stored values. An organization-scoped non-super-admin override requires at least one feature grant. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "userId": "00000000-0000-4000-8000-000000000000", "organizations": null } ``` ### Responses **200** – User ACL updated Content-Type: `application/json` ```json { "ok": true, "sanitized": true } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient privileges to modify ACL Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/auth/users/acl" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"userId\": \"00000000-0000-4000-8000-000000000000\", \"organizations\": null }" ``` ## GET `/auth/users/consents` List user consents Returns all consent records for a given user, with integrity verification status. **Tags:** Auth **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | userId | query | any | Required | ### Responses **200** – Consent list returned Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/auth/users/consents?userId=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/auth/users/resend-invite` Resend invitation email Resends the invitation email to a user who has not yet set up their password. Generates a new 48-hour setup token and invalidates prior tokens. **Tags:** Authentication & Accounts **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Invite email sent Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid request origin Content-Type: `application/json` ```json { "error": "string" } ``` **404** – User not found Content-Type: `application/json` ```json { "error": "string" } ``` **409** – User already has a password Content-Type: `application/json` ```json { "error": "string" } ``` **422** – Validation error Content-Type: `application/json` ```json { "error": "string" } ``` **429** – Rate limit exceeded Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Invitation email origin is not configured Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/auth/users/resend-invite" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/configs/cache` Get cache statistics Returns detailed cache statistics including total entries and breakdown by cache segments. Requires cache service to be available. **Tags:** Configs **Requires authentication.** ### Responses **200** – Cache statistics Content-Type: `application/json` ```json { "generatedAt": "string", "totalKeys": 1, "segments": [ { "segment": "string", "resource": null, "method": null, "path": null, "keyCount": 1, "keys": [ "string" ] } ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to resolve cache stats Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Cache service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/configs/cache" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/configs/cache` Purge cache Purges cache entries. Supports two actions: purgeAll (clears entire cache) or purgeSegment (clears specific segment). Returns updated cache statistics after purge. **Tags:** Configs **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "action": "purgeAll" } ``` ### Responses **200** – Cache segment cleared successfully Content-Type: `application/json` ```json { "action": "purgeSegment", "segment": "string", "deleted": 1, "stats": { "generatedAt": "string", "totalKeys": 1, "segments": [ { "segment": "string", "resource": null, "method": null, "path": null, "keyCount": 1, "keys": [ "string" ] } ] } } ``` **400** – Invalid request - missing segment identifier for purgeSegment action Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to purge cache Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Cache service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/configs/cache" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"action\": \"purgeAll\" }" ``` ## DELETE `/configs/module-telemetry` Clear module telemetry data Development-only endpoint that clears in-memory module telemetry and local process telemetry files. **Tags:** Configs **Requires authentication.** ### Responses **200** – Module telemetry cleared Content-Type: `application/json` ```json { "cleared": true } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forbidden outside development mode Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/configs/module-telemetry" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/configs/module-telemetry` Get module resource usage telemetry Returns in-process module resource attribution for API routes, event subscribers, and queue workers. **Tags:** Configs **Requires authentication.** ### Responses **200** – Module resource usage report Content-Type: `application/json` ```json { "generatedAt": "string", "startedAt": "string", "enabled": true, "bucketIntervalMs": 1, "totals": { "modules": 1, "operations": 1, "calls": 1, "errors": 1, "totalDurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1 }, "thresholds": { "p95DurationMs": 1, "cpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1, "errors": 1 }, "modules": [ { "moduleId": "string", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1, "surfaces": [ { "surface": "api", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1 } ], "topOperations": [ { "moduleId": "string", "surface": "api", "operation": "string", "resourceId": null, "calls": 1, "errors": 1, "totalDurationMs": 1, "maxDurationMs": 1, "p95DurationMs": 1, "totalCpuUserMs": 1, "totalCpuSystemMs": 1, "maxCpuMs": 1, "totalHeapDeltaBytes": 1, "positiveHeapDeltaBytes": 1, "maxHeapDeltaBytes": 1, "totalRssDeltaBytes": 1, "positiveRssDeltaBytes": 1, "maxRssDeltaBytes": 1, "firstSeenAt": "string", "lastSeenAt": "string" } ], "candidateReasons": [ "string" ] } ], "candidates": [ { "moduleId": "string", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1, "surfaces": [ { "surface": "api", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1 } ], "topOperations": [ { "moduleId": "string", "surface": "api", "operation": "string", "resourceId": null, "calls": 1, "errors": 1, "totalDurationMs": 1, "maxDurationMs": 1, "p95DurationMs": 1, "totalCpuUserMs": 1, "totalCpuSystemMs": 1, "maxCpuMs": 1, "totalHeapDeltaBytes": 1, "positiveHeapDeltaBytes": 1, "maxHeapDeltaBytes": 1, "totalRssDeltaBytes": 1, "positiveRssDeltaBytes": 1, "maxRssDeltaBytes": 1, "firstSeenAt": "string", "lastSeenAt": "string" } ], "candidateReasons": [ "string" ] } ], "buckets": [ { "bucketStart": "string", "bucketEnd": "string", "bucketIntervalMs": 1, "stage": "startup", "partial": true, "totals": { "modules": 1, "calls": 1, "errors": 1, "totalDurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1 }, "modules": [ { "moduleId": "string", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1, "surfaces": [ { "surface": "api", "calls": 1, "errors": 1, "totalDurationMs": 1, "p95DurationMs": 1, "totalCpuMs": 1, "positiveHeapDeltaBytes": 1, "positiveRssDeltaBytes": 1 } ], "topOperations": [ { "moduleId": "string", "surface": "api", "operation": "string", "resourceId": null, "calls": 1, "errors": 1, "totalDurationMs": 1, "maxDurationMs": 1, "p95DurationMs": 1, "totalCpuUserMs": 1, "totalCpuSystemMs": 1, "maxCpuMs": 1, "totalHeapDeltaBytes": 1, "positiveHeapDeltaBytes": 1, "maxHeapDeltaBytes": 1, "totalRssDeltaBytes": 1, "positiveRssDeltaBytes": 1, "maxRssDeltaBytes": 1, "firstSeenAt": "string", "lastSeenAt": "string" } ], "candidateReasons": [ "string" ] } ] } ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/configs/module-telemetry" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/configs/system-status` Get system health status Returns comprehensive system health information including environment details, version, resource usage, and service connectivity status. **Tags:** Configs **Requires authentication.** ### Responses **200** – System status snapshot Content-Type: `application/json` ```json { "generatedAt": "string", "runtimeMode": "development", "categories": [ { "key": "profiling", "labelKey": "string", "descriptionKey": null, "items": [ { "key": "string", "category": "profiling", "kind": "boolean", "labelKey": "string", "descriptionKey": "string", "docUrl": null, "defaultValue": null, "state": "enabled", "value": null, "normalizedValue": null } ] } ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to load system status Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/configs/system-status" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/configs/system-status` Clear system cache Purges the entire cache for the current tenant. Useful for troubleshooting or forcing fresh data loading. **Tags:** Configs **Requires authentication.** ### Responses **200** – Cache cleared successfully Content-Type: `application/json` ```json { "cleared": true } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to purge cache Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Cache service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/configs/system-status" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/configs/upgrade-actions` List pending upgrade actions Returns a list of pending upgrade actions for the current version. These are one-time setup tasks that need to be executed after upgrading to a new version. Requires organization and tenant context. **Tags:** Configs **Requires authentication.** ### Responses **200** – List of pending upgrade actions Content-Type: `application/json` ```json { "version": "string", "actions": [ { "id": "string", "version": "string", "message": "string", "ctaLabel": "string", "successMessage": "string", "loadingLabel": "string" } ] } ``` **400** – Missing organization or tenant context Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to load upgrade actions Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/configs/upgrade-actions" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/configs/upgrade-actions` Execute upgrade action Executes a specific upgrade action by ID. Typically used for one-time setup tasks like seeding example data after version upgrade. Returns execution status and localized success message. **Tags:** Configs **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "actionId": "string" } ``` ### Responses **200** – Upgrade action executed successfully Content-Type: `application/json` ```json { "status": "string", "message": "string", "version": "string" } ``` **400** – Invalid request body or missing context Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Upgrade actions are disabled Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to execute upgrade action Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/configs/upgrade-actions" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"actionId\": \"string\" }" ``` ## GET `/dashboards/layout` Load the current dashboard layout Returns the saved widget layout together with the widgets the current user is allowed to place. **Tags:** Dashboards **Requires authentication.** ### Responses **200** – Current dashboard layout and available widgets. Content-Type: `application/json` ```json { "layout": { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "widgetId": "string", "order": 1 } ] }, "allowedWidgetIds": [ "string" ], "canConfigure": true, "context": { "userId": "00000000-0000-4000-8000-000000000000", "tenantId": null, "organizationId": null, "userName": null, "userEmail": null, "userLabel": "string" }, "widgets": [ { "id": "string", "title": "string", "description": null, "defaultSize": "sm", "defaultEnabled": true, "defaultSettings": null, "features": [ "string" ], "moduleId": "string", "icon": null, "loaderKey": "string", "supportsRefresh": true } ] } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/dashboards/layout" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/dashboards/layout` Persist dashboard layout changes Saves the provided widget ordering, sizes, and settings for the current user. **Tags:** Dashboards **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "widgetId": "string", "order": 1 } ] } ``` ### Responses **200** – Layout updated successfully. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid layout payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing dashboards.configure feature Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Widget registry unavailable — the layout was not saved Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/dashboards/layout" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"items\": [ { \"id\": \"00000000-0000-4000-8000-000000000000\", \"widgetId\": \"string\", \"order\": 1 } ] }" ``` ## PATCH `/dashboards/layout/{itemId}` Update a dashboard layout item Adjusts the size or settings for a single widget within the dashboard layout. **Tags:** Dashboards **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | itemId | path | any | Required | ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Layout item updated. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Invalid payload or missing item id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing dashboards.configure feature Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Item not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PATCH "https://server.tail3470ec.ts.net/api/dashboards/layout/00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## GET `/dashboards/roles/widgets` Fetch widget assignments for a role Returns the widgets explicitly assigned to the given role together with the evaluation scope. **Tags:** Dashboards **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | roleId | query | any | Required | | tenantId | query | any | Optional | | organizationId | query | any | Optional | ### Responses **200** – Current widget configuration for the role. Content-Type: `application/json` ```json { "widgetIds": [ "string" ], "hasCustom": true, "scope": { "tenantId": null, "organizationId": null } } ``` **400** – Missing role identifier Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient permissions to manage role widgets Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/dashboards/roles/widgets?roleId=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/dashboards/roles/widgets` Update widgets assigned to a role Persists the widget list for a role within the provided tenant and organization scope. **Tags:** Dashboards **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "roleId": "00000000-0000-4000-8000-000000000000", "widgetIds": [ "string" ] } ``` ### Responses **200** – Widgets updated successfully. Content-Type: `application/json` ```json { "ok": true, "widgetIds": [ "string" ] } ``` **400** – Invalid payload or unknown widgets Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient permissions to manage role widgets Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/dashboards/roles/widgets" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"roleId\": \"00000000-0000-4000-8000-000000000000\", \"widgetIds\": [ \"string\" ] }" ``` ## GET `/dashboards/users/widgets` Read widget overrides for a user Returns the widgets inherited and explicitly configured for the requested user within the current scope. **Tags:** Dashboards **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | userId | query | any | Required | | tenantId | query | any | Optional | | organizationId | query | any | Optional | ### Responses **200** – Widget settings for the user. Content-Type: `application/json` ```json { "mode": "inherit", "widgetIds": [ "string" ], "hasCustom": true, "effectiveWidgetIds": [ "string" ], "scope": { "tenantId": null, "organizationId": null } } ``` **400** – Missing user identifier Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient permissions to manage user widgets Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/dashboards/users/widgets?userId=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/dashboards/users/widgets` Update user-specific dashboard widgets Sets the widget override mode and allowed widgets for a user. Passing `mode: inherit` clears overrides. **Tags:** Dashboards **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "userId": "00000000-0000-4000-8000-000000000000", "mode": "inherit", "widgetIds": [ "string" ] } ``` ### Responses **200** – Overrides saved. Content-Type: `application/json` ```json { "ok": true, "mode": "inherit", "widgetIds": [ "string" ] } ``` **400** – Invalid payload or unknown widgets Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient permissions to manage user widgets Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/dashboards/users/widgets" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"userId\": \"00000000-0000-4000-8000-000000000000\", \"mode\": \"inherit\", \"widgetIds\": [ \"string\" ] }" ``` ## GET `/dashboards/widgets/catalog` List available dashboard widgets Returns the catalog of widgets that modules expose, including defaults and feature requirements. **Tags:** Dashboards **Requires authentication.** ### Responses **200** – Widgets available for assignment. Content-Type: `application/json` ```json { "items": [ { "id": "string", "title": "string", "description": null, "defaultSize": "sm", "defaultEnabled": true, "defaultSettings": null, "features": [ "string" ], "moduleId": "string", "icon": null, "loaderKey": "string", "supportsRefresh": true } ] } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Insufficient permissions to view widget catalog Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/dashboards/widgets/catalog" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/dashboards/widgets/data` Fetch aggregated data for dashboard widgets Executes an aggregation query against the specified entity type and returns the result. Supports date range filtering, grouping, and period-over-period comparison. **Tags:** Dashboards **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityType": "string", "metric": { "field": "string", "aggregate": "count" } } ``` ### Responses **200** – Aggregated data for the widget. Content-Type: `application/json` ```json { "value": null, "data": [ { "value": null } ], "metadata": { "fetchedAt": "string", "recordCount": 1, "currency": null } } ``` **400** – Invalid request payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing analytics.view feature Content-Type: `application/json` ```json { "error": "string" } ``` **422** – Too many rows to group an encrypted field in application code Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Internal server error Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Encryption is configured but the group source cannot currently be resolved Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/dashboards/widgets/data" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityType\": \"string\", \"metric\": { \"field\": \"string\", \"aggregate\": \"count\" } }" ``` ## POST `/dashboards/widgets/data/batch` Fetch aggregated data for multiple dashboard widgets in one request Resolves a batch of widget data requests with a single authentication, RBAC, organization-scope, and database-context setup. Each request is keyed by an opaque widget id and resolved independently, so a failure in one widget does not fail the batch. **Tags:** Dashboards **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "requests": [ { "id": "string", "request": { "entityType": "string", "metric": { "field": "string", "aggregate": "count" } } } ] } ``` ### Responses **200** – Per-widget aggregation results keyed by request id. Content-Type: `application/json` ```json { "results": [ { "id": "string", "ok": true, "data": { "value": null, "data": [ { "value": null } ], "metadata": { "fetchedAt": "string", "recordCount": 1, "currency": null } } } ] } ``` **400** – Invalid request payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Internal server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/dashboards/widgets/data/batch" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"requests\": [ { \"id\": \"string\", \"request\": { \"entityType\": \"string\", \"metric\": { \"field\": \"string\", \"aggregate\": \"count\" } } } ] }" ``` ## GET `/directory/organization-branding` Read sidebar branding for the selected organization Returns the logo URL used by the backend sidebar for the currently selected organization. **Tags:** Directory **Requires authentication.** ### Responses **200** – Organization branding Content-Type: `application/json` ```json { "organizationId": "00000000-0000-4000-8000-000000000000", "organizationName": "string", "tenantId": "00000000-0000-4000-8000-000000000000", "logoUrl": null, "logoPreserveAspectRatio": true, "updatedAt": null } ``` **400** – A concrete organization scope is required Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Organization not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/organization-branding" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/directory/organization-branding` Update sidebar branding for the selected organization Stores an external image URL or an internal attachment image URL as the selected organization logo. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "logoUrl": null } ``` ### Responses **200** – Updated organization branding Content-Type: `application/json` ```json { "organizationId": "00000000-0000-4000-8000-000000000000", "organizationName": "string", "tenantId": "00000000-0000-4000-8000-000000000000", "logoUrl": null, "logoPreserveAspectRatio": true, "updatedAt": null } ``` **400** – Save failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Organization branding changed since it was loaded Content-Type: `application/json` ```json { "error": "string" } ``` **422** – Invalid logo URL Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/directory/organization-branding" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"logoUrl\": null }" ``` ## GET `/directory/organization-switcher` Load organization switcher menu Returns the hierarchical menu of organizations the current user may switch to within the active tenant. **Tags:** Directory **Requires authentication.** ### Responses **200** – Organization switcher payload. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "depth": 1, "selectable": true, "children": [] } ], "selectedId": null, "canManage": true, "canViewAllOrganizations": true, "tenantId": null, "tenants": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true } ], "isSuperAdmin": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/organization-switcher" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/directory/organizations` Delete organization Soft deletes an organization identified by id. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Organization deleted. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.organizations.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/directory/organizations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/directory/organizations` List organizations Returns organizations using options, tree, or paginated manage view depending on the `view` parameter. **Tags:** Directory **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | page | query | any | Optional | | pageSize | query | any | Optional | | search | query | any | Optional | | view | query | any | Optional | | ids | query | any | Optional | | tenantId | query | any | Optional | | includeInactive | query | any | Optional | | status | query | any | Optional | ### Responses **200** – Organization data for the requested view. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "parentId": null, "parentName": null, "tenantId": null, "tenantName": null, "rootId": null, "treePath": null } ] } ``` **400** – Invalid query or tenant scope Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/organizations?page=1&pageSize=50&view=options" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/directory/organizations` Create organization Creates a new organization within a tenant and optionally assigns hierarchy relationships. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string", "slug": null, "logoUrl": null, "parentId": null } ``` ### Responses **201** – Organization created. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.organizations.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/directory/organizations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\", \"slug\": null, \"logoUrl\": null, \"parentId\": null }" ``` ## PUT `/directory/organizations` Update organization Updates organization details and hierarchy assignments. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "slug": null, "logoUrl": null, "parentId": null } ``` ### Responses **200** – Organization updated. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.organizations.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/directory/organizations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\", \"slug\": null, \"logoUrl\": null, \"parentId\": null }" ``` ## GET `/directory/organizations/lookup` Public organization lookup by slug **Tags:** Directory (Tenants & Organizations) ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/organizations/lookup" \ -H "Accept: application/json" ``` ## DELETE `/directory/tenants` Delete tenant Soft deletes the tenant identified by id. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Tenant removed. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.tenants.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/directory/tenants" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/directory/tenants` List tenants Returns tenants visible to the current user with optional search and pagination. **Tags:** Directory **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | search | query | any | Optional | | sortField | query | any | Optional | | sortDir | query | any | Optional | | isActive | query | any | Optional | ### Responses **200** – Paged list of tenants. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "isActive": true, "createdAt": null, "updatedAt": null } ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1 } ``` **400** – Invalid query parameters Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Requires super-admin Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/tenants?page=1&pageSize=50" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/directory/tenants` Create tenant Creates a new tenant and returns its identifier. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string" } ``` ### Responses **201** – Tenant created. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.tenants.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/directory/tenants" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\" }" ``` ## PUT `/directory/tenants` Update tenant Updates tenant properties such as name or activation state. **Tags:** Directory **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Tenant updated. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing directory.tenants.manage feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/directory/tenants" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/directory/tenants/lookup` Public tenant lookup **Tags:** Directory (Tenants & Organizations) ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/directory/tenants/lookup" \ -H "Accept: application/json" ``` ## DELETE `/entities/definitions` Soft delete custom field definition Marks the specified definition inactive and tombstones it for the current scope. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "key": "string" } ``` ### Responses **200** – Definition deleted Content-Type: `application/json` ```json { "ok": true, "version": null } ``` **400** – Missing entity id or key Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Definition not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/entities/definitions" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"key\": \"string\" }" ``` ## GET `/entities/definitions` List active custom field definitions Returns active custom field definitions for the supplied entity ids, respecting tenant scope and tombstones. **Tags:** Entities **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Optional | | entityIds | query | any | Optional | | fieldset | query | any | Optional | ### Responses **200** – Definition list Content-Type: `application/json` ```json { "items": [ { "key": "string", "kind": "string", "label": "string", "entityId": "string" } ] } ``` **400** – Missing entity id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/definitions" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/entities/definitions` Upsert custom field definition Creates or updates a custom field definition for the current tenant/org scope. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "key": "string", "kind": "text" } ``` ### Responses **200** – Definition saved Content-Type: `application/json` ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000000", "key": "string", "kind": "string", "configJson": {} } } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/definitions" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"key\": \"string\", \"kind\": \"text\" }" ``` ## POST `/entities/definitions.batch` Save multiple custom field definitions Creates or updates multiple definitions for a single entity in one transaction. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "definitions": [ { "key": "string", "kind": "text" } ] } ``` ### Responses **200** – Definitions saved Content-Type: `application/json` ```json { "ok": true, "version": null } ``` **400** – Validation error Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected failure Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/definitions.batch" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"definitions\": [ { \"key\": \"string\", \"kind\": \"text\" } ] }" ``` ## GET `/entities/definitions.manage` Get management snapshot Returns scoped custom field definitions (including inactive tombstones) for administration interfaces. **Tags:** Entities **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Required | ### Responses **200** – Scoped definitions and deleted keys Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "key": "string", "kind": "string", "configJson": null, "organizationId": null, "tenantId": null } ], "deletedKeys": [ "string" ], "version": null } ``` **400** – Missing entity id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication or feature Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/definitions.manage?entityId=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/entities/definitions.restore` Restore definition Reactivates a previously soft-deleted definition within the current tenant/org scope. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "key": "string" } ``` ### Responses **200** – Definition restored Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing entity id or key Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Definition not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/definitions.restore" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"key\": \"string\" }" ``` ## GET `/entities/encryption` Fetch encryption map Returns the encrypted field map for the current tenant/organization scope. **Tags:** Entities **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Required | ### Responses **200** – Map Content-Type: `application/json` ```json { "entityId": "string", "fields": [ { "field": "string", "hashField": null } ], "updatedAt": null } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/encryption?entityId=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/entities/encryption` Upsert encryption map Creates or updates the encryption map for the current tenant/organization scope. Enforces optimistic locking when the caller sends the expected version header. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "tenantId": null, "organizationId": null, "fields": [ { "field": "string", "hashField": null } ] } ``` ### Responses **200** – Saved Content-Type: `application/json` ```json { "ok": true, "updatedAt": null } ``` **409** – Optimistic-lock conflict (stale write) Content-Type: `application/json` ```json { "error": "string", "code": "string", "currentUpdatedAt": "string", "expectedUpdatedAt": "string" } ``` **422** – Selected organization is unavailable Content-Type: `application/json` ```json { "error": "string", "code": "organization_selection_invalid" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/encryption" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"tenantId\": null, \"organizationId\": null, \"fields\": [ { \"field\": \"string\", \"hashField\": null } ] }" ``` ## DELETE `/entities/entities` Soft delete custom entity Marks the specified custom entity inactive within the current scope. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string" } ``` ### Responses **200** – Entity deleted Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing entity id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Entity not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/entities/entities" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\" }" ``` ## GET `/entities/entities` List available entities Returns generated and custom entities scoped to the caller with field counts per entity. **Tags:** Entities **Requires authentication.** ### Responses **200** – List of entities Content-Type: `application/json` ```json { "items": [ { "entityId": "string", "source": "code", "label": "string", "count": 1 } ] } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/entities" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/entities/entities` Upsert custom entity Creates or updates a tenant/org scoped custom entity definition. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "label": "string", "description": null, "showInSidebar": false, "accessRestricted": false } ``` ### Responses **200** – Entity saved Content-Type: `application/json` ```json { "ok": true, "item": { "id": "00000000-0000-4000-8000-000000000000", "entityId": "string", "label": "string" } } ``` **400** – Validation error Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/entities" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"label\": \"string\", \"description\": null, \"showInSidebar\": false, \"accessRestricted\": false }" ``` ## GET `/entities/entity-settings` Get custom entity settings Returns the tenant-scoped default-restricted policy for new custom entities. **Tags:** Entities **Requires authentication.** ### Responses **200** – Current settings Content-Type: `application/json` ```json { "newEntitiesRestrictedByDefault": true, "updatedAt": null } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/entity-settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/entities/entity-settings` Update custom entity settings Sets the tenant-scoped default-restricted policy for new custom entities. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "newEntitiesRestrictedByDefault": true } ``` ### Responses **200** – Updated settings Content-Type: `application/json` ```json { "ok": true, "newEntitiesRestrictedByDefault": true, "updatedAt": null } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Optimistic lock conflict Content-Type: `application/json` ```json { "code": "string", "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/entities/entity-settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"newEntitiesRestrictedByDefault\": true }" ``` ## DELETE `/entities/records` Delete record Soft deletes the specified record within the current tenant/org scope. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "recordId": "string" } ``` ### Responses **200** – Record deleted Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing entity id or record id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Record not found Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected failure Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/entities/records" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"recordId\": \"string\" }" ``` ## GET `/entities/records` List records Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles. **Tags:** Entities **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Required | | page | query | any | Optional | | pageSize | query | any | Optional | | sortField | query | any | Optional | | sortDir | query | any | Optional | | search | query | any | Optional | | searchFields | query | any | Optional | | withDeleted | query | any | Optional | | format | query | any | Optional | | exportScope | query | any | Optional | | export_scope | query | any | Optional | | all | query | any | Optional | | full | query | any | Optional | ### Responses **200** – Paginated records Content-Type: `application/json` ```json { "items": [ {} ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1 } ``` **400** – Missing entity id Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected failure Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/records?entityId=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/entities/records` Create record Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "values": {} } ``` ### Responses **200** – Record created Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failure Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected failure Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/entities/records" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"values\": {} }" ``` ## PUT `/entities/records` Update record Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows. **Tags:** Entities **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityId": "string", "recordId": "string", "values": {} } ``` ### Responses **200** – Record updated Content-Type: `application/json` ```json { "ok": true } ``` **400** – Validation failure Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected failure Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/entities/records" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityId\": \"string\", \"recordId\": \"string\", \"values\": {} }" ``` ## GET `/entities/relations/options` List relation options Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted. An entityId that matches neither an active custom entity nor a registered ORM entity yields an empty option list. **Tags:** Entities **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Required | | labelField | query | any | Optional | | q | query | any | Optional | | ids | query | any | Optional | | routeContextFields | query | any | Optional | ### Responses **200** – Option list Content-Type: `application/json` ```json { "items": [ { "value": "string", "label": "string" } ] } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/relations/options?entityId=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/entities/sidebar-entities` Get sidebar entities Returns custom entities flagged with `showInSidebar` for the current tenant/org scope. **Tags:** Entities **Requires authentication.** ### Responses **200** – Sidebar entities for navigation Content-Type: `application/json` ```json { "items": [ { "entityId": "string", "label": "string", "href": "string" } ] } ``` **401** – Missing authentication Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/entities/sidebar-entities" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/events` List declared events Returns every declared event. Filters: category, module, excludeTriggerExcluded (default true). **Tags:** Events **Requires authentication.** ### Responses **200** – Declared events Content-Type: `application/json` ```json { "data": [ { "id": "string", "label": "string" } ], "total": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/events" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/events/stream` GET /events/stream **Tags:** Events **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/events/stream" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/check/boolean` Check if feature is enabled Checks if a feature toggle is enabled for the current context. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | identifier | query | any | Required. Feature toggle identifier | ### Responses **200** – Feature status Content-Type: `application/json` ```json { "enabled": true, "source": "override", "toggleId": "string", "identifier": "string", "tenantId": "string" } ``` **400** – Bad Request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Tenant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/check/boolean?identifier=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/check/json` Get json config Gets the json configuration for a feature toggle. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | identifier | query | any | Required. Feature toggle identifier | ### Responses **200** – Json config Content-Type: `application/json` ```json { "valueType": "json", "source": "override", "toggleId": "string", "identifier": "string", "tenantId": "string" } ``` **400** – Bad Request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Tenant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/check/json?identifier=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/check/number` Get number config Gets the number configuration for a feature toggle. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | identifier | query | any | Required. Feature toggle identifier | ### Responses **200** – Number config Content-Type: `application/json` ```json { "valueType": "number", "value": 1, "source": "override", "toggleId": "string", "identifier": "string", "tenantId": "string" } ``` **400** – Bad Request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Tenant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/check/number?identifier=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/check/string` Get string config Gets the string configuration for a feature toggle. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | identifier | query | any | Required. Feature toggle identifier | ### Responses **200** – String config Content-Type: `application/json` ```json { "valueType": "string", "value": "string", "source": "override", "toggleId": "string", "identifier": "string", "tenantId": "string" } ``` **400** – Bad Request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Tenant not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/check/string?identifier=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/feature_toggles/global` Delete global feature toggle Soft deletes a global feature toggle by ID. Requires superadmin role. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Required. Feature toggle identifier | ### Responses **200** – Feature toggle deleted Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Invalid identifier Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forbidden - superadmin role required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Feature toggle not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/feature_toggles/global?id=00000000-0000-4000-8000-000000000000" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/global` List global feature toggles Returns all global feature toggles with filtering and pagination. Requires superadmin role. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | page | query | any | Optional. Page number for pagination | | pageSize | query | any | Optional. Number of items per page (max 200) | | search | query | any | Optional. Case-insensitive search across identifier, name, description, and category | | type | query | any | Optional. Filter by toggle type (boolean, string, number, json) | | category | query | any | Optional. Filter by category (case-insensitive partial match) | | name | query | any | Optional. Filter by name (case-insensitive partial match) | | identifier | query | any | Optional. Filter by identifier (case-insensitive partial match) | | sortField | query | any | Optional. Field to sort by | | sortDir | query | any | Optional. Sort direction (ascending or descending) | ### Responses **200** – Feature toggles collection Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "identifier": "string", "name": "string", "description": null, "category": null, "type": "boolean", "defaultValue": null, "createdAt": null, "updatedAt": null } ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1 } ``` **400** – Invalid query parameters Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forbidden - superadmin role required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/global?page=1&pageSize=50" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/feature_toggles/global` Create global feature toggle Creates a new global feature toggle. Requires superadmin role. **Tags:** Feature Toggles **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "identifier": "string", "name": "string", "description": null, "category": null, "type": "boolean", "defaultValue": null } ``` ### Responses **201** – Feature toggle created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forbidden - superadmin role required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/feature_toggles/global" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"identifier\": \"string\", \"name\": \"string\", \"description\": null, \"category\": null, \"type\": \"boolean\", \"defaultValue\": null }" ``` ## PUT `/feature_toggles/global` Update global feature toggle Updates an existing global feature toggle. Requires superadmin role. **Tags:** Feature Toggles **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "description": null, "category": null, "defaultValue": null } ``` ### Responses **200** – Feature toggle updated Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forbidden - superadmin role required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Feature toggle not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/feature_toggles/global" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\", \"description\": null, \"category\": null, \"defaultValue\": null }" ``` ## GET `/feature_toggles/global/{id}` Fetch feature toggle by ID Returns complete details of a feature toggle. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Feature toggle detail Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "identifier": "string", "name": "string", "description": null, "category": null, "type": "boolean", "defaultValue": null, "createdAt": null, "updatedAt": null } ``` **400** – Invalid identifier Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Feature toggle not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/global/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/global/{id}/override` Fetch feature toggle override Returns feature toggle override. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Feature toggle overrides Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "tenantName": "string", "tenantId": "00000000-0000-4000-8000-000000000000", "toggleType": "boolean", "updatedAt": null } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Feature toggle not found Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/global/:id/override" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/feature_toggles/overrides` List overrides Returns list of feature toggle overrides. **Tags:** Feature Toggles **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | category | query | any | Optional | | name | query | any | Optional | | identifier | query | any | Optional | | sortField | query | any | Optional | | sortDir | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | ### Responses **200** – List of overrides Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "toggleId": "00000000-0000-4000-8000-000000000000", "tenantName": "string", "tenantId": "00000000-0000-4000-8000-000000000000", "identifier": "string", "name": "string", "category": "string", "isOverride": true } ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1, "isSuperAdmin": true } ``` **400** – Invalid query parameters Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/feature_toggles/overrides?page=1&pageSize=25" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/feature_toggles/overrides` Change override state Enable, disable or inherit a feature toggle for a specific tenant. **Tags:** Feature Toggles **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "toggleId": "00000000-0000-4000-8000-000000000000", "isOverride": true } ``` ### Responses **200** – Override updated Content-Type: `application/json` ```json { "ok": true, "overrideToggleId": null } ``` **400** – Validation failed Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Not found Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Internal server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/feature_toggles/overrides" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"toggleId\": \"00000000-0000-4000-8000-000000000000\", \"isOverride\": true }" ``` ## GET `/forms_reports/settings` Resolve the tr3.forms_reports feature flag Returns whether forms and reports are enabled for the caller tenant. **Tags:** Forms and reports **Requires authentication.** ### Responses **200** – Resolved settings. Content-Type: `application/json` ```json { "enabled": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/forms_reports/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/forms_reports/submissions` List form submissions Returns a paginated collection of form submissions in the current tenant and organization scope. **Tags:** Forms and reports **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | workOrderId | query | any | Optional | | templateId | query | any | Optional | | templateIds | query | any | Optional | | qcIssueId | query | any | Optional | | submittedByUserId | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated form submissions Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "templateId": "00000000-0000-4000-8000-000000000000", "qcIssueId": null, "templateName": "string", "templateSchemaVersion": 1, "status": "string", "payload": {}, "submittedByUserId": null, "submittedAt": null, "pdfMediaId": null, "pdfStatus": "string", "voided": true, "voidReason": null, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/forms_reports/submissions?sortField=submitted_at&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/forms_reports/submissions/{id}/void` Withdraw a filed submission Marks the submission voided with a mandatory reason. The record and its attachments survive — there is no edit and no delete. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Forms and reports **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "reason": "string" } ``` ### Responses **200** – Submission voided. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "templateId": "00000000-0000-4000-8000-000000000000", "templateName": "string", "templateSchemaVersion": 1, "status": "string", "pdfStatus": "string", "pdfMediaId": null, "voided": true, "submittedAt": null, "updatedAt": null } ``` **400** – A reason is required Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Submission not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or already voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/forms_reports/submissions/:id/void" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"reason\": \"string\" }" ``` ## POST `/forms_reports/submissions/submit` File a form submission against a work order Requires a work order that is open or in progress, a published template, and a payload that satisfies the template definition frozen at submit time. Photos and signatures are referenced by media id. Submissions cannot be edited afterwards — use the void endpoint to correct one. **Tags:** Forms and reports **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "workOrderId": "00000000-0000-4000-8000-000000000000", "templateId": "00000000-0000-4000-8000-000000000000", "qcIssueId": null, "payload": {} } ``` ### Responses **201** – Submission filed. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "templateId": "00000000-0000-4000-8000-000000000000", "templateName": "string", "templateSchemaVersion": 1, "status": "string", "pdfStatus": "string", "pdfMediaId": null, "voided": true, "submittedAt": null, "updatedAt": null } ``` **400** – Invalid payload, work order not accepting submissions, or template not published Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forms are disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/forms_reports/submissions/submit" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"workOrderId\": \"00000000-0000-4000-8000-000000000000\", \"templateId\": \"00000000-0000-4000-8000-000000000000\", \"qcIssueId\": null, \"payload\": {} }" ``` ## DELETE `/forms_reports/templates` Delete form template Soft-deletes a template. Submissions keep their scalar `templateId` and their own frozen definition, so filed protocols stay readable. **Tags:** Forms and reports **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Form Template deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/forms_reports/templates" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/forms_reports/templates` List form templates Returns a paginated collection of form templates in the current tenant and organization scope. **Tags:** Forms and reports **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | search | query | any | Optional | | status | query | any | Optional | | purpose | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated form templates Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "description": null, "status": "string", "purpose": "string", "source": "string", "schemaVersion": 1, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/forms_reports/templates?sortField=name&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/forms_reports/templates` Create form template Creates a template. New templates start as drafts unless a status is given. **Tags:** Forms and reports **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string", "description": null, "definition": { "sections": [ { "id": "string", "title": "string", "fields": [ { "id": "string", "type": "text", "label": "string" } ] } ] } } ``` ### Responses **201** – Form Template created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/forms_reports/templates" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\", \"description\": null, \"definition\": { \"sections\": [ { \"id\": \"string\", \"title\": \"string\", \"fields\": [ { \"id\": \"string\", \"type\": \"text\", \"label\": \"string\" } ] } ] } }" ``` ## PUT `/forms_reports/templates` Update form template Updates a template, including publish and archive through `status`. Changing `definition` bumps `schemaVersion`, which submissions freeze. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Forms and reports **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "description": null, "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Form Template updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/forms_reports/templates" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"description\": null, \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## POST `/forms_reports/templates/import-llm` Create a draft template from an uploaded PDF or photo Reads a PDF or photo already uploaded through the media module and creates a DRAFT form template from it, with `source=llm_import`. The import never publishes: an administrator reviews and publishes the draft. When no model provider is configured the draft is a starter skeleton and `extracted` is false. **Tags:** Forms and reports **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "mediaId": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **201** – Draft template created. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "purpose": "string", "fieldCount": 1, "extracted": true } ``` **400** – Invalid payload, unknown document, or unsupported file type Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Forms are disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/forms_reports/templates/import-llm" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"mediaId\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/media` List media attached to one or more records Filters by a single `refModule`/`refType`/`refId` triple, by several triples at once through `refs` (comma-separated `module:type:id`), or by explicit `ids`. Voided objects are excluded unless `includeVoided` is set. **Tags:** Media **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional | | refModule | query | any | Optional | | refType | query | any | Optional | | refId | query | any | Optional | | refs | query | any | Optional | | kind | query | any | Optional | | role | query | any | Optional | | includeVoided | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | ### Responses **200** – Matching media. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "kind": "string", "filename": "string", "contentType": "string", "byteSize": 1, "checksum": null, "createdByUserId": null, "voided": true, "createdAt": null, "updatedAt": null, "links": [ { "refModule": "string", "refType": "string", "refId": "00000000-0000-4000-8000-000000000000", "role": null } ], "contentUrl": "string" } ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1 } ``` **400** – Invalid query Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/media?includeVoided=false&page=1&pageSize=100" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/media/{id}` Read one media object Returns filename, content type, size, checksum and every link the object carries in scope. **Tags:** Media **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – The media object. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "kind": "string", "filename": "string", "contentType": "string", "byteSize": 1, "checksum": null, "createdByUserId": null, "voided": true, "createdAt": null, "updatedAt": null, "links": [ { "refModule": "string", "refType": "string", "refId": "00000000-0000-4000-8000-000000000000", "role": null } ], "contentUrl": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/media/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/media/{id}/content` Stream the stored bytes Serves one media object to a caller holding `media.read`, or to anyone presenting a valid short-lived `token` minted by the signed-url endpoint. Voided objects are refused. **Tags:** Media ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – The stored bytes. Content-Type: `application/json` **401** – No session and no valid token Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Not found in scope, or voided Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/media/:id/content" \ -H "Accept: application/json" ``` ## POST `/media/{id}/signed-url` Create a short-lived download link Returns a URL valid for 15 minutes that serves this one object without a session. **Tags:** Media **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Signed URL. Content-Type: `application/json` ```json { "url": "string", "expiresAt": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Not found in scope, or voided Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/media/:id/signed-url" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/media/{id}/void` Soft-hide a media object Marks the object voided: galleries stop listing it and the content route refuses it. The row and the bytes survive — there is no hard delete in the MVP. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Media **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Object voided. Content-Type: `application/json` ```json { "checksum": null, "createdByUserId": null, "createdAt": null, "updatedAt": null } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or already voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/media/:id/void" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/media/links` Create a media link Attaches an existing media object to a record of any module through the polymorphic reference triple. Repeating the same object, reference and role returns the existing link. **Tags:** Media **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "refModule": "string", "refType": "string", "refId": "00000000-0000-4000-8000-000000000000", "mediaId": "00000000-0000-4000-8000-000000000000", "role": null } ``` ### Responses **201** – Link created (or already present). Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "mediaId": "00000000-0000-4000-8000-000000000000", "refModule": "string", "refType": "string", "refId": "00000000-0000-4000-8000-000000000000", "role": null, "createdAt": null } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Media is disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Media object not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – The media object is voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/media/links" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"refModule\": \"string\", \"refType\": \"string\", \"refId\": \"00000000-0000-4000-8000-000000000000\", \"mediaId\": \"00000000-0000-4000-8000-000000000000\", \"role\": null }" ``` ## GET `/media/settings` Resolve the tr3.media feature flag and upload limits Returns whether media is enabled for the caller tenant, the maximum upload size and the accepted content types. **Tags:** Media **Requires authentication.** ### Responses **200** – Resolved settings. Content-Type: `application/json` ```json { "enabled": true, "maxUploadBytes": 1, "acceptedContentTypes": [ "string" ] } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/media/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/media/upload` Upload a file, photo or signature PNG Stores one object (max 20 MB; jpeg, png, webp or pdf) and optionally attaches it to a record in the same request. The caller module is responsible for its own status gates before asking for the upload. **Tags:** Media **Requires authentication.** ### Request Body Content-Type: `multipart/form-data` ```text file=string ``` ### Responses **201** – Media stored. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "kind": "string", "filename": "string", "contentType": "string", "byteSize": 1, "checksum": null, "createdByUserId": null, "voided": true, "createdAt": null, "updatedAt": null, "links": [ { "refModule": "string", "refType": "string", "refId": "00000000-0000-4000-8000-000000000000", "role": null } ], "contentUrl": "string", "link": null } ``` **400** – Missing file or malformed reference Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Media is disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **413** – File exceeds the 20 MB limit Content-Type: `application/json` ```json { "error": "string" } ``` **415** – Content type is not allow-listed Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/media/upload" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: multipart/form-data" \ -d "{ \"file\": \"string\" }" ``` ## GET `/notifications` List notifications Returns a paginated collection of notifications. **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | status | query | any | Optional | | type | query | any | Optional | | severity | query | any | Optional | | sourceEntityType | query | any | Optional | | sourceEntityId | query | any | Optional | | since | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | ### Responses **200** – Paginated notifications Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "type": "string", "title": "string", "body": null, "titleKey": null, "bodyKey": null, "titleVariables": null, "bodyVariables": null, "icon": null, "severity": "string", "status": "string", "actions": [ { "id": "string", "label": "string" } ], "sourceModule": null, "sourceEntityType": null, "sourceEntityId": null, "linkHref": null, "createdAt": "string", "readAt": null, "actionTaken": null } ], "total": 1, "page": 1, "pageSize": 1, "totalPages": 1 } ``` **403** – Request could not be resolved to a tenant scope (code: tenant_scope_required) Content-Type: `application/json` ```json { "error": "string", "code": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications?page=1&pageSize=20" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/notifications` Create notification Creates a notification for a user. **Tags:** Notifications **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "type": "string", "severity": "info", "recipientUserId": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **201** – Notification created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"type\": \"string\", \"severity\": \"info\", \"recipientUserId\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## POST `/notifications/{id}/action` POST /notifications/{id}/action **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **201** – Success response Content-Type: `application/json` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications/:id/action" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/{id}/dismiss` PUT /notifications/{id}/dismiss **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/:id/dismiss" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/{id}/read` PUT /notifications/{id}/read **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/:id/read" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/{id}/restore` PUT /notifications/{id}/restore **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/:id/restore" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/admin/preferences` GET /notifications/admin/preferences **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/admin/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/admin/preferences` PUT /notifications/admin/preferences **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/admin/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/notifications/batch` POST /notifications/batch **Tags:** Notifications **Requires authentication.** ### Responses **201** – Success response Content-Type: `application/json` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications/batch" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/channels` GET /notifications/channels **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/channels" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/notifications/feature` POST /notifications/feature **Tags:** Notifications **Requires authentication.** ### Responses **201** – Success response Content-Type: `application/json` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications/feature" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/mark-all-read` PUT /notifications/mark-all-read **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/mark-all-read" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/preferences` GET /notifications/preferences **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/preferences` PUT /notifications/preferences **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/preferences" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/notifications/role` POST /notifications/role **Tags:** Notifications **Requires authentication.** ### Responses **201** – Success response Content-Type: `application/json` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications/role" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/settings` GET /notifications/settings **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/notifications/settings` POST /notifications/settings **Tags:** Notifications **Requires authentication.** ### Responses **201** – Success response Content-Type: `application/json` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/notifications/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/types` GET /notifications/types **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/types" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PATCH `/notifications/types` PATCH /notifications/types **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PATCH "https://server.tail3470ec.ts.net/api/notifications/types" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/notifications/types/{id}/channels/{channel}` DELETE /notifications/types/{id}/channels/{channel} **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | | channel | path | any | Required | ### Responses **204** – Success ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/notifications/types/:id/channels/:channel" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/notifications/types/{id}/channels/{channel}` PUT /notifications/types/{id}/channels/{channel} **Tags:** Notifications **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | | channel | path | any | Required | ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/notifications/types/:id/channels/:channel" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/notifications/unread-count` GET /notifications/unread-count **Tags:** Notifications **Requires authentication.** ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/notifications/unread-count" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/ops/customers` Delete customer Soft-deletes a customer by id. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Customer deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/ops/customers" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/ops/customers` List customers Returns a paginated collection of customers in the current tenant and organization scope. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | search | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated customers Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "taxId": null, "email": null, "phone": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/customers?sortField=name&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/ops/customers` Create customer Creates a customer in the caller tenant and organization scope. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string", "taxId": null, "email": null, "phone": null } ``` ### Responses **201** – Customer created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/ops/customers" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\", \"taxId\": null, \"email\": null, \"phone\": null }" ``` ## PUT `/ops/customers` Update customer Updates a customer. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "taxId": null, "email": null, "phone": null, "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Customer updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/ops/customers" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"taxId\": null, \"email\": null, \"phone\": null, \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## DELETE `/ops/sites` Delete site Soft-deletes a site by id. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Site deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/ops/sites" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/ops/sites` List sites Returns a paginated collection of sites in the current tenant and organization scope. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | search | query | any | Optional | | customerId | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated sites Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "customerId": null, "addressLine": null, "city": null, "country": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/sites?sortField=name&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/ops/sites` Create site Creates a site. `customerId` is a scoped soft reference and is validated on write. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string", "customerId": null, "addressLine": null, "city": null, "country": null } ``` ### Responses **201** – Site created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/ops/sites" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\", \"customerId\": null, \"addressLine\": null, \"city\": null, \"country\": null }" ``` ## PUT `/ops/sites` Update site Updates a site. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "customerId": null, "addressLine": null, "city": null, "country": null, "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Site updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/ops/sites" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"customerId\": null, \"addressLine\": null, \"city\": null, \"country\": null, \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/ops/users` List assignable operators Returns selectable users in the caller tenant and organization scope. **Tags:** Operations **Requires authentication.** ### Responses **200** – Assignable operators. Content-Type: `application/json` ```json { "items": [ { "value": "string", "label": "string" } ] } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/users" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/ops/work-orders` Delete work order Soft-deletes a work order by id. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Work Order deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/ops/work-orders" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/ops/work-orders` List work orders Returns a paginated collection of work orders in the current tenant and organization scope. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | search | query | any | Optional | | status | query | any | Optional | | priority | query | any | Optional | | customerId | query | any | Optional | | siteId | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated work orders Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "title": "string", "description": null, "customerId": null, "siteId": null, "status": "string", "priority": "string", "scheduledStart": null, "scheduledEnd": null, "closedAt": null, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/work-orders?sortField=created_at&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/ops/work-orders` Create work order Creates a work order. The `WO-YYYY-#####` number is allocated server-side and is unique per tenant. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "title": "string", "description": null, "customerId": null, "siteId": null, "status": "open", "priority": "normal", "scheduledStart": null, "scheduledEnd": null } ``` ### Responses **201** – Work Order created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/ops/work-orders" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"title\": \"string\", \"description\": null, \"customerId\": null, \"siteId\": null, \"status\": \"open\", \"priority\": \"normal\", \"scheduledStart\": null, \"scheduledEnd\": null }" ``` ## PUT `/ops/work-orders` Update work order Updates a work order. `status` is not accepted here — use POST /api/ops/work-orders/{id}/status so the lifecycle transition is validated. **Tags:** Operations **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "description": null, "customerId": null, "siteId": null, "scheduledStart": null, "scheduledEnd": null } ``` ### Responses **200** – Work Order updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/ops/work-orders" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\", \"description\": null, \"customerId\": null, \"siteId\": null, \"scheduledStart\": null, \"scheduledEnd\": null }" ``` ## GET `/ops/work-orders/{id}/assignees` List work order assignees Returns the operator user ids currently assigned to a work order. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Assigned operators. Content-Type: `application/json` ```json { "items": [ { "userId": "00000000-0000-4000-8000-000000000000" } ] } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Work order not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/work-orders/:id/assignees" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/ops/work-orders/{id}/assignees` Replace work order assignees Replaces the entire assignee set. Idempotent: re-sending the same list converges on the same rows. Send the work order `updatedAt` as the optimistic-lock header. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "userIds": [ "00000000-0000-4000-8000-000000000000" ] } ``` ### Responses **200** – Assignees replaced. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "userIds": [ "00000000-0000-4000-8000-000000000000" ], "updatedAt": null } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Work order not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/ops/work-orders/:id/assignees" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"userIds\": [ \"00000000-0000-4000-8000-000000000000\" ] }" ``` ## POST `/ops/work-orders/{id}/status` Change a work order status Moves a work order through draft → open → in_progress → done, or to cancelled. Rejects a transition the lifecycle does not allow. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Operations **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "status": "draft" } ``` ### Responses **200** – Status applied. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "updatedAt": null } ``` **400** – Invalid or disallowed transition Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Work order not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version or unchanged status Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/ops/work-orders/:id/status" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"status\": \"draft\" }" ``` ## GET `/ops/work-orders/assigned` List the open work orders the calling operator may work on Returns open and in-progress work orders in the caller scope: those the caller is assigned to, plus those with no assignees at all. **Tags:** Operations **Requires authentication.** ### Responses **200** – Work orders the operator may pick up. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "title": "string", "status": "string", "priority": "string", "customerName": null, "siteName": null, "scheduledStart": null, "assignedToMe": true, "startable": true } ] } ``` **400** – Organization scope could not be resolved Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/work-orders/assigned" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/ops/work-orders/by-number` Resolve one work order from the number typed or scanned on a terminal Returns the operator tile for the work order carrying this number in the caller scope, including work orders that are already closed (`startable: false`). A work order the caller may not pick up is reported as not found. **Tags:** Operations **Requires authentication.** ### Responses **200** – The resolved work order. Content-Type: `application/json` ```json { "item": { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "title": "string", "status": "string", "priority": "string", "customerName": null, "siteName": null, "scheduledStart": null, "assignedToMe": true, "startable": true } } ``` **400** – Missing number, or unresolvable organization scope Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – No such work order in the caller scope Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/ops/work-orders/by-number" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/qc/issues` List quality issues Returns a paginated collection of quality issues in the current tenant and organization scope. **Tags:** Quality control **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | workOrderId | query | any | Optional | | kind | query | any | Optional | | status | query | any | Optional | | severity | query | any | Optional | | ownerUserId | query | any | Optional | | unassigned | query | any | Optional | | reportedByUserId | query | any | Optional | | overdue | query | any | Optional | | includeVoided | query | any | Optional | | search | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated quality issues Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "string", "title": "string", "description": null, "status": "string", "severity": "string", "reportedByUserId": null, "reportedAt": null, "ownerUserId": null, "dueAt": null, "resolutionNote": null, "resolvedAt": null, "closedAt": null, "voided": true, "voidReason": null, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/qc/issues?sortField=reported_at&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/qc/issues` Create quality issue Reports a non-conformity or a production problem against a work order. The work order must exist in scope and must not be a draft — `done` and `cancelled` are accepted on purpose. Photos are media ids uploaded through `POST /api/media/upload` beforehand. **Tags:** Quality control **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "ncr", "title": "string", "description": null } ``` ### Responses **201** – Quality Issue created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "number": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/qc/issues" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"workOrderId\": \"00000000-0000-4000-8000-000000000000\", \"kind\": \"ncr\", \"title\": \"string\", \"description\": null }" ``` ## GET `/qc/issues/{id}` Read one quality issue Returns the issue, including a voided one so its reason stays inspectable. **Tags:** Quality control **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – The issue. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "string", "title": "string", "description": null, "status": "string", "severity": "string", "reportedByUserId": null, "reportedAt": null, "ownerUserId": null, "dueAt": null, "resolutionNote": null, "resolvedAt": null, "closedAt": null, "voided": true, "voidReason": null, "createdAt": null, "updatedAt": null } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Issue not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/qc/issues/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/qc/issues/{id}` Triage a quality issue Sets kind, severity, owner and due date and corrects the text in one write. `kind` stays changeable until the issue is closed. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Quality control **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "ownerUserId": null, "dueAt": null, "description": null } ``` ### Responses **200** – Issue triaged. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "string", "status": "string", "severity": "string", "ownerUserId": null, "dueAt": null, "voided": true, "updatedAt": null } ``` **400** – Invalid payload Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Quality control is disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Issue not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, issue closed, or issue voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/qc/issues/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"ownerUserId\": null, \"dueAt\": null, \"description\": null }" ``` ## POST `/qc/issues/{id}/status` Move a quality issue through its lifecycle Moves an issue along open → in_progress → resolved → closed, including the office shortcut open → closed and the reopen closed → in_progress. Entering `resolved`, and the shortcut, require a resolution note. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Quality control **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "status": "open", "resolutionNote": null } ``` ### Responses **200** – Status applied. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "string", "status": "string", "severity": "string", "ownerUserId": null, "dueAt": null, "voided": true, "updatedAt": null } ``` **400** – Missing owner or resolution note Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – The caller may not make this move, or QC is disabled Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Issue not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, disallowed transition, unchanged status, or voided issue Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/qc/issues/:id/status" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"status\": \"open\", \"resolutionNote\": null }" ``` ## POST `/qc/issues/{id}/void` Withdraw a quality issue from the counters Marks the issue voided with a mandatory reason. The record and its photos survive — there is no delete. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Quality control **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "reason": "string" } ``` ### Responses **200** – Issue voided. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "number": "string", "workOrderId": "00000000-0000-4000-8000-000000000000", "kind": "string", "status": "string", "severity": "string", "ownerUserId": null, "dueAt": null, "voided": true, "updatedAt": null } ``` **400** – A reason is required Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Quality control is disabled for this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Issue not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or already voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/qc/issues/:id/void" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"reason\": \"string\" }" ``` ## GET `/qc/settings` Resolve the tr3.qc feature flag Returns whether quality control is enabled for the caller tenant, whether forms and reports are enabled, and whether QC checklists are available — which requires both. **Tags:** Quality control **Requires authentication.** ### Responses **200** – Resolved settings. Content-Type: `application/json` ```json { "enabled": true, "formsReportsEnabled": true, "checklistsEnabled": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/qc/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/query_index/purge` Purge query index records Queues a purge job to remove indexed records for an entity type within the active scope. **Tags:** Query Index **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityType": "string" } ``` ### Responses **200** – Purge job accepted. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing entity type Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/query_index/purge" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityType\": \"string\" }" ``` ## POST `/query_index/reindex` Trigger query index rebuild Queues a reindex job for the specified entity type within the current tenant scope. **Tags:** Query Index **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "entityType": "string" } ``` ### Responses **200** – Reindex job accepted. Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing entity type Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/query_index/reindex" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"entityType\": \"string\" }" ``` ## GET `/query_index/status` Inspect query index coverage Returns entity counts comparing base tables with the query index along with the latest job status. **Tags:** Query Index **Requires authentication.** ### Responses **200** – Current query index status. Content-Type: `application/json` ```json { "items": [ { "entityId": "string", "label": "string", "baseCount": null, "indexCount": null, "vectorCount": null, "fulltextCount": null, "ok": true, "job": { "status": "idle", "startedAt": null, "finishedAt": null, "heartbeatAt": null, "processedCount": null, "totalCount": null, "scope": null }, "refreshedAt": null } ], "errors": [ { "id": "string", "source": "string", "handler": "string", "entityType": null, "recordId": null, "tenantId": null, "organizationId": null, "message": "string", "stack": null, "payload": null, "occurredAt": "string" } ], "logs": [ { "id": "string", "source": "string", "handler": "string", "level": "info", "entityType": null, "recordId": null, "tenantId": null, "organizationId": null, "message": "string", "details": null, "occurredAt": "string" } ] } ``` **400** – Tenant or organization context required Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/query_index/status" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/embeddings` Get embeddings configuration Returns current embedding provider and model configuration. **Tags:** Search **Requires authentication.** ### Responses **200** – Embeddings settings Content-Type: `application/json` ```json { "settings": { "openaiConfigured": true, "autoIndexingEnabled": true, "autoIndexingLocked": true, "lockReason": null, "embeddingConfig": null, "configuredProviders": [ "openai" ], "indexedDimension": null, "reindexRequired": true, "documentCount": null } } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/embeddings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/search/embeddings` Update embeddings configuration Updates the embedding provider and model settings. **Tags:** Search **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Updated settings Content-Type: `application/json` ```json { "settings": { "openaiConfigured": true, "autoIndexingEnabled": true, "autoIndexingLocked": true, "lockReason": null, "embeddingConfig": null, "configuredProviders": [ "openai" ], "indexedDimension": null, "reindexRequired": true, "documentCount": null } } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Auto-indexing disabled via environment Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Update failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Configuration service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/embeddings" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/search/embeddings/reindex` Trigger vector reindex Starts a vector embedding reindex operation. **Tags:** Search **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Reindex result Content-Type: `application/json` ```json { "ok": true } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Reindex already in progress Content-Type: `application/json` ```json { "error": "string", "lock": { "type": "fulltext", "action": "string", "startedAt": "string", "elapsedMinutes": 1, "processedCount": null, "totalCount": null } } ``` **500** – Reindex failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Search indexer unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/embeddings/reindex" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/search/embeddings/reindex/cancel` Cancel vector reindex Cancels an in-progress vector reindex operation. **Tags:** Search **Requires authentication.** ### Responses **200** – Cancel result Content-Type: `application/json` ```json { "ok": true, "jobsRemoved": 1 } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/embeddings/reindex/cancel" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/search/index` Purge vector index Purges entries from the vector search index. Requires confirmAll=true when purging all entities. **Tags:** Search **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Optional. Specific entity ID to purge (e.g., "customers:customer_person_profile", "catalog:catalog_product") | | confirmAll | query | any | Optional. Required when purging all entities | ### Responses **200** – Purge result Content-Type: `application/json` ```json { "ok": true } ``` **400** – Missing confirmAll parameter Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Purge failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Search indexer unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/search/index" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/index` List vector index entries Returns paginated list of entries in the vector search index. **Tags:** Search **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | entityId | query | any | Optional. Filter by entity ID (e.g., "customers:customer_person_profile", "catalog:catalog_product") | | limit | query | any | Optional. Maximum entries to return (default: 50, max: 200) | | offset | query | any | Optional. Offset for pagination (default: 0) | ### Responses **200** – Index entries Content-Type: `application/json` ```json { "entries": [ { "id": "string", "entityId": "string", "recordId": "string", "tenantId": "string", "organizationId": null } ], "limit": 1, "offset": 1 } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Failed to fetch index Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Vector strategy unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/index" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/search/reindex` Trigger fulltext reindex Starts a fulltext (Meilisearch) reindex operation. Can clear, recreate, or fully reindex. **Tags:** Search **Requires authentication.** ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Reindex result Content-Type: `application/json` ```json { "ok": true, "action": "clear", "entityId": null } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Reindex already in progress Content-Type: `application/json` ```json { "error": "string", "lock": { "type": "fulltext", "action": "string", "startedAt": "string", "elapsedMinutes": 1, "processedCount": null, "totalCount": null } } ``` **500** – Reindex failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Search service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/reindex" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/search/reindex/cancel` Cancel fulltext reindex Cancels an in-progress fulltext reindex operation. **Tags:** Search **Requires authentication.** ### Responses **200** – Cancel result Content-Type: `application/json` ```json { "ok": true, "jobsRemoved": 1 } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/reindex/cancel" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/search` Search across all indexed entities Performs a search using configured strategies (fulltext, vector, tokens). Use for search playground. Results are limited to the entity types the caller holds the declared view features for; superadmins are exempt. **Tags:** Search **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | q | query | any | Required. Search query (required) | | limit | query | any | Optional. Maximum results to return (default: 50, max: 100) | | strategies | query | any | Optional. Comma-separated strategies to use: fulltext, vector, tokens (e.g., "fulltext,vector") | | entityTypes | query | any | Optional. Comma-separated entity types to filter results (e.g., "customers:customer_person_profile,catalog:catalog_product,sales:sales_order") | ### Responses **200** – Search results Content-Type: `application/json` ```json { "results": [ { "entityId": "string", "recordId": "string", "score": 1, "source": "fulltext" } ], "strategiesUsed": [ "fulltext" ], "timing": 1, "query": "string", "limit": 1 } ``` **400** – Missing query parameter Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Search failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Search service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/search?q=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/search/global` Global search (Cmd+K) Performs a global search using saved tenant strategies. Does NOT accept strategies from URL. **Tags:** Search **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | q | query | any | Required. Search query (required) | | limit | query | any | Optional. Maximum results to return (default: 50, max: 100) | | entityTypes | query | any | Optional. Comma-separated entity types to filter results (e.g., "customers:customer_person_profile,catalog:catalog_product,sales:sales_order") | ### Responses **200** – Search results Content-Type: `application/json` ```json { "results": [ { "entityId": "string", "recordId": "string", "score": 1, "source": "fulltext" } ], "strategiesUsed": [ "fulltext" ], "strategiesEnabled": [ "fulltext" ], "timing": 1, "query": "string", "limit": 1 } ``` **400** – Missing query parameter Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Search failed Content-Type: `application/json` ```json { "error": "string" } ``` **503** – Search service unavailable Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/search/global?q=string" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/settings` Get search settings and status Returns search module configuration, available strategies, and reindex lock status. **Tags:** Search **Requires authentication.** ### Responses **200** – Search settings Content-Type: `application/json` ```json { "settings": { "strategies": [ { "id": "string", "name": "string", "priority": 1, "available": true } ], "fulltextConfigured": true, "fulltextStats": null, "vectorConfigured": true, "tokensEnabled": true, "defaultStrategies": [ "string" ], "reindexLock": null, "fulltextReindexLock": null, "vectorReindexLock": null } } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/settings/fulltext` Get fulltext search configuration Returns Meilisearch configuration status and index statistics. **Tags:** Search **Requires authentication.** ### Responses **200** – Fulltext settings Content-Type: `application/json` ```json { "driver": null, "configured": true, "envVars": { "MEILISEARCH_HOST": { "set": true, "hint": "string" }, "MEILISEARCH_API_KEY": { "set": true, "hint": "string" } }, "optionalEnvVars": { "MEILISEARCH_INDEX_PREFIX": { "set": true, "hint": "string" }, "SEARCH_EXCLUDE_ENCRYPTED_FIELDS": { "set": true, "hint": "string" } } } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/settings/fulltext" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/search/settings/global-search` Get global search strategies Returns the enabled strategies for Cmd+K global search. **Tags:** Search **Requires authentication.** ### Responses **200** – Global search settings Content-Type: `application/json` ```json { "enabledStrategies": [ "fulltext" ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/settings/global-search" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/search/settings/global-search` Update global search strategies Sets which strategies are enabled for Cmd+K global search. **Tags:** Search **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "enabledStrategies": [ "fulltext" ] } ``` ### Responses **200** – Updated settings Content-Type: `application/json` ```json { "ok": true, "enabledStrategies": [ "fulltext" ] } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Internal error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/search/settings/global-search" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"enabledStrategies\": [ \"fulltext\" ] }" ``` ## GET `/search/settings/vector-store` Get vector store configuration Returns vector store configuration status. **Tags:** Search **Requires authentication.** ### Responses **200** – Vector store settings Content-Type: `application/json` ```json { "currentDriver": "pgvector", "configured": true, "drivers": [ { "id": "pgvector", "name": "string", "configured": true, "implemented": true, "available": null, "unavailableReason": null, "envVars": [ { "name": "string", "set": true, "hint": "string" } ] } ] } ``` **401** – Unauthorized Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/search/settings/vector-store" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/time/operations` Delete operation Soft-deletes an operation. Sessions keep their scalar `operation_id`, so historical labels stay resolvable. **Tags:** Time tracking **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Operation deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/time/operations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/time/operations` List operations Returns a paginated collection of operations in the current tenant and organization scope. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | search | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated operations Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "name": "string", "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/time/operations?sortField=name&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/time/operations` Create operation Creates an operation label that sessions may reference. **Tags:** Time tracking **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string" } ``` ### Responses **201** – Operation created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/operations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\" }" ``` ## PUT `/time/operations` Update operation Renames an operation. Send the record `updatedAt` as the optimistic-lock header. **Tags:** Time tracking **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Operation updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/time/operations" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/time/sessions` List time sessions Returns a paginated collection of time sessions in the current tenant and organization scope. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | workOrderId | query | any | Optional | | userId | query | any | Optional | | status | query | any | Optional | | operationId | query | any | Optional | | sortField | query | any | Optional | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | ### Responses **200** – Paginated time sessions Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "userId": "00000000-0000-4000-8000-000000000000", "status": "string", "startedAt": null, "endedAt": null, "pauseStartedAt": null, "activeSince": null, "durationWorkedSeconds": 1, "note": null, "operationId": null, "voided": true, "voidReason": null, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/time/sessions?sortField=started_at&page=1&pageSize=50&sortDir=desc" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/time/sessions/{id}/pause` Pause a running time session Freezes the clock: the running segment is banked into `durationWorkedSeconds` and `pauseStartedAt` is set. Only the operator who owns the session may pause it. Send the session `updatedAt` as the optimistic-lock header. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Session paused. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "durationWorkedSeconds": 1, "updatedAt": null } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – The session belongs to another operator Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Session not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or the session is not running Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/sessions/:id/pause" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/time/sessions/{id}/resume` Resume a paused time session Opens a new running segment and clears `pauseStartedAt`. `startedAt` is left untouched — it records when the shift began, not the current segment. Send the session `updatedAt` as the optimistic-lock header. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json {} ``` ### Responses **200** – Session resumed. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "durationWorkedSeconds": 1, "updatedAt": null } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – The session belongs to another operator Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Session not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or the session is not paused Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/sessions/:id/resume" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{}" ``` ## POST `/time/sessions/{id}/stop` Stop a running or paused time session Finalizes `durationWorkedSeconds`, sets `endedAt`, and frees the operator to start elsewhere. A stopped session can never be deleted — use the void endpoint to correct one. Send the session `updatedAt` as the optimistic-lock header. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "note": null } ``` ### Responses **200** – Session stopped. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "durationWorkedSeconds": 1, "updatedAt": null } ``` **400** – Invalid request Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – The session belongs to another operator Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Session not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or the session is already stopped Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/sessions/:id/stop" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"note\": null }" ``` ## POST `/time/sessions/{id}/void` Void a time session with a reason Excludes the session from every total while keeping the record and the stated reason. A still-open session is stopped first, so a voided record never leaves its operator clocked in. Send the session `updatedAt` as the optimistic-lock header. **Tags:** Time tracking **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Request Body Content-Type: `application/json` ```json { "reason": "string" } ``` ### Responses **200** – Session voided. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "durationWorkedSeconds": 1, "updatedAt": null } ``` **400** – A reason is required Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – Session not found in scope Content-Type: `application/json` ```json { "error": "string" } ``` **409** – Stale version, or the session is already voided Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/sessions/:id/void" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"reason\": \"string\" }" ``` ## POST `/time/sessions/start` Start a time session on a work order Opens a running session for the authenticated operator. Requires an operation from the tenant catalog, the work order to be open or in progress, the operator to be assigned when the work order names assignees, and the operator to have no other running or paused session anywhere in the tenant. **Tags:** Time tracking **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "workOrderId": "00000000-0000-4000-8000-000000000000", "operationId": "00000000-0000-4000-8000-000000000000", "note": null } ``` ### Responses **201** – Session started. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "workOrderId": "00000000-0000-4000-8000-000000000000", "status": "string", "previousStatus": "string", "durationWorkedSeconds": 1, "updatedAt": null } ``` **400** – Missing or unknown operation, invalid payload, or the work order does not accept sessions Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Time tracking disabled, or the operator is not assigned Content-Type: `application/json` ```json { "error": "string" } ``` **409** – The operator already has an active session Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/time/sessions/start" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"workOrderId\": \"00000000-0000-4000-8000-000000000000\", \"operationId\": \"00000000-0000-4000-8000-000000000000\", \"note\": null }" ``` ## GET `/time/settings` Resolve the tr3.time feature flag Returns whether time tracking is enabled for the caller tenant. **Tags:** Time tracking **Requires authentication.** ### Responses **200** – Resolved settings. Content-Type: `application/json` ```json { "enabled": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/time/settings" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/version` Deployed Open Mercato version **Tags:** API Documentation ### Responses **200** – Success response Content-Type: `application/json` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/version" \ -H "Accept: application/json" ``` ## POST `/workforce/kiosk/bind` Bind this device to a tenant with an unlock code Claims a single-use unlock code, creates a kiosk device in the code's tenant and sets the `tr3_kiosk` cookie. Invalid, used, expired and cancelled codes return one identical 400. Failed attempts are rate limited per IP and per browser. **Tags:** Workforce ### Request Body Content-Type: `application/json` ```json { "code": "string" } ``` ### Responses **200** – Bound. Content-Type: `application/json` ```json { "ok": true, "deviceLabel": null, "tenantName": "string" } ``` **400** – Invalid, used, expired or cancelled code (`workforce.errors.unlock_code_invalid`) Content-Type: `application/json` ```json { "error": "string" } ``` **429** – Too many failed codes Content-Type: `application/json` ```json { "error": "workforce.errors.kiosk_locked", "retryAfter": 1 } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/kiosk/bind" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d "{ \"code\": \"string\" }" ``` ## GET `/workforce/kiosk/devices` List kiosk devices of the tenant Live devices plus devices revoked in the last 7 days. Never includes the kiosk token or its hash. **Tags:** Workforce **Requires authentication.** ### Responses **200** – Devices. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "label": null, "boundAt": null, "lastSeenAt": null, "lockedUntil": null, "revokedAt": null, "status": "active" } ], "total": 1, "totalPages": 1 } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/kiosk/devices" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/workforce/kiosk/devices/{id}` Revoke a kiosk device and end its operator sessions **Tags:** Workforce **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Revoked. Content-Type: `application/json` ```json { "ok": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – No device with that id in this tenant Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/workforce/kiosk/devices/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## GET `/workforce/kiosk/status` Whether this device is bound to a tenant Resolves the `tr3_kiosk` cookie to a live kiosk device. Returns `{ bound: false }` for no, a revoked or an unknown binding (and clears a dead cookie), or the device label, tenant name and current lock expiry. Touches `last_seen_at`. **Tags:** Workforce ### Responses **200** – Binding status. Content-Type: `application/json` ```json { "bound": false } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/kiosk/status" \ -H "Accept: application/json" ``` ## POST `/workforce/kiosk/unbind` Unbind this device from its tenant Requires the `tr3_kiosk` cookie. Revokes the kiosk device, ends every operator session issued through it and clears the kiosk and session cookies. **Tags:** Workforce ### Responses **200** – Unbound. Content-Type: `application/json` ```json { "ok": true } ``` **403** – No live binding on this device (`workforce.errors.kiosk_unbound`) Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/kiosk/unbind" \ -H "Accept: application/json" ``` ## GET `/workforce/kiosk/unlock-codes` List pending kiosk unlock codes Unused, uncancelled and unexpired unlock codes of the tenant. Never includes the code itself. **Tags:** Workforce **Requires authentication.** ### Responses **200** – Pending codes. Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "label": null, "expiresAt": "string", "createdAt": null } ], "total": 1, "totalPages": 1 } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/kiosk/unlock-codes" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/workforce/kiosk/unlock-codes` Generate a kiosk unlock code Issues a single-use `XXXX-XXXX` code valid for 15 minutes, scoped to the caller's tenant and organization. The plaintext appears only in this response. **Tags:** Workforce **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "label": null } ``` ### Responses **201** – Code issued. Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000", "label": null, "expiresAt": "string", "createdAt": null, "code": "string" } ``` **400** – Invalid label or no organization context Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/kiosk/unlock-codes" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"label\": null }" ``` ## DELETE `/workforce/kiosk/unlock-codes/{id}` Cancel an unused kiosk unlock code **Tags:** Workforce **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | id | path | any | Required | ### Responses **200** – Cancelled. Content-Type: `application/json` ```json { "ok": true } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **404** – No pending code with that id Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/workforce/kiosk/unlock-codes/:id" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/workforce/operator/login` Sign in a production operator with a PIN Requires a live kiosk binding (`tr3_kiosk` cookie). Resolves the operator by the bound device's tenant and the PIN fingerprint, verifies the bcrypt hash and issues the standard staff session cookies for the operator's backing user. Every wrong-PIN mode returns the same 401 and counts against the device; 5 failures lock the device for 300 seconds. **Tags:** Workforce ### Request Body Content-Type: `application/json` ```json { "pin": "string" } ``` ### Responses **200** – Signed in. Content-Type: `application/json` ```json { "ok": true, "redirect": "string", "operator": { "id": "00000000-0000-4000-8000-000000000000", "name": "string" } } ``` **401** – Unknown PIN, or a deactivated operator Content-Type: `application/json` ```json { "error": "string" } ``` **403** – This device is not bound to a tenant (`workforce.errors.kiosk_unbound`) Content-Type: `application/json` ```json { "error": "string" } ``` **429** – Device locked after failed PINs (`workforce.errors.kiosk_locked`, with `retryAfter`), or per-IP rate limit Content-Type: `application/json` ```json { "error": "workforce.errors.kiosk_locked", "retryAfter": 1 } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/operator/login" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -d "{ \"pin\": \"string\" }" ``` ## POST `/workforce/operator/logout` Sign the current operator out of the terminal Clears the session cookies and revokes the server-side session so a shared tablet is handed over clean. Keeps the `tr3_kiosk` binding cookie. **Tags:** Workforce ### Responses **200** – Signed out. Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/operator/logout" \ -H "Accept: application/json" ``` ## GET `/workforce/operator/me` Resolve the production operator behind the current session Requires a live kiosk binding in the session tenant. Returns the operator row linked to the authenticated user, or a null operator id for an office user, plus the device label. **Tags:** Workforce **Requires authentication.** ### Responses **200** – Operator identity. Content-Type: `application/json` ```json { "operatorId": null, "userId": "00000000-0000-4000-8000-000000000000", "name": "string", "code": null, "deviceLabel": null } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – No live kiosk binding for the session tenant (`workforce.errors.kiosk_unbound`) Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/operator/me" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## DELETE `/workforce/operators` Delete production operator Soft-deletes a production operator. The backing user is kept. **Tags:** Workforce **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Production Operator deleted Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X DELETE "https://server.tail3470ec.ts.net/api/workforce/operators" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/workforce/operators` List production operators Returns a paginated collection of production operators in the current tenant and organization scope. **Tags:** Workforce **Requires authentication.** ### Parameters | Name | Location | Type | Description | | --- | --- | --- | --- | | page | query | any | Optional | | pageSize | query | any | Optional | | sortDir | query | any | Optional | | sortField | query | any | Optional | | search | query | any | Optional | | id | query | any | Optional | | ids | query | any | Optional. Comma-separated list of record UUIDs to filter by (max 200). | | active | query | any | Optional | ### Responses **200** – Paginated production operators Content-Type: `application/json` ```json { "items": [ { "id": "00000000-0000-4000-8000-000000000000", "userId": "00000000-0000-4000-8000-000000000000", "code": null, "name": "string", "active": true, "lastLoginAt": null, "createdAt": null, "updatedAt": null } ], "total": 1, "totalPages": 1 } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/operators?page=1&pageSize=50&sortDir=asc&sortField=name" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## POST `/workforce/operators` Create production operator Creates a production operator. When `userId` is omitted an `auth` user with the `employee` role is provisioned for the operator. The PIN is stored as a bcrypt hash plus a keyed fingerprint and is never returned; it must not already be in use by another operator of the same tenant (409 `workforce.errors.pin_taken`). **Tags:** Workforce **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "name": "string", "pin": "string", "userId": null } ``` ### Responses **201** – Production Operator created Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Example ```bash curl -X POST "https://server.tail3470ec.ts.net/api/workforce/operators" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"name\": \"string\", \"pin\": \"string\", \"userId\": null }" ``` ## PUT `/workforce/operators` Update production operator Updates a production operator. Omit `pin` to leave the current PIN unchanged. **Tags:** Workforce **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "id": "00000000-0000-4000-8000-000000000000" } ``` ### Responses **200** – Production Operator updated Content-Type: `application/json` ```json { "ok": true } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/workforce/operators" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"id\": \"00000000-0000-4000-8000-000000000000\" }" ``` ## GET `/workforce/settings/work-order-entry-mode` Resolve how the terminal asks for a work order Returns the tenant value of the `tr3.work_order_entry_mode` string toggle: `list`, `type` or `scan`. Falls back to `list` whenever the toggle cannot be resolved. **Tags:** Workforce **Requires authentication.** ### Responses **200** – Resolved settings. Content-Type: `application/json` ```json { "workOrderEntryMode": "list" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **500** – Unexpected server error Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X GET "https://server.tail3470ec.ts.net/api/workforce/settings/work-order-entry-mode" \ -H "Accept: application/json" \ -H "authorization: Bearer " ``` ## PUT `/workforce/settings/work-order-entry-mode` Change the work order entry mode for the caller tenant Records a per-tenant override on the `tr3.work_order_entry_mode` feature toggle. The tenant is taken from the session, never from the payload. **Tags:** Workforce **Requires authentication.** ### Request Body Content-Type: `application/json` ```json { "workOrderEntryMode": "list" } ``` ### Responses **200** – Mode changed. Content-Type: `application/json` ```json { "workOrderEntryMode": "list" } ``` **400** – Invalid mode, or the toggle definition has not been seeded Content-Type: `application/json` ```json { "error": "string" } ``` **401** – Authentication required Content-Type: `application/json` ```json { "error": "string" } ``` **403** – Missing workforce.settings.manage Content-Type: `application/json` ```json { "error": "string" } ``` ### Example ```bash curl -X PUT "https://server.tail3470ec.ts.net/api/workforce/settings/work-order-entry-mode" \ -H "Accept: application/json" \ -H "authorization: Bearer " \ -H "Content-Type: application/json" \ -d "{ \"workOrderEntryMode\": \"list\" }" ```