API explorer

Static reference for in-house developers. Generated 2026-07-22T23:20:33.956Z · 443 endpoints in 35 sections.

Source: docs/API-ENDPOINTS-CATALOG.md → frontend/src/data/apiEndpointsCatalog.json · Regenerate: node scripts/build-api-catalog.mjs

Interactive app: Admin → Developers → API reference book (/admin/api-reference) — same data, search + cURL copy.

Filter

Catalog intro (from markdown)

# API Endpoints Catalog

**Purpose:** Full list of API endpoints (method + path). Multi-tenant: tenant is resolved by session or headers (X-Tenant-Slug, X-Org-Id) unless noted.  
**Last updated:** April 4, 2026.  
**See also:** `FULL-WIRING-MAP.md` (middleware per prefix), `HOW-IT-ACTUALLY-WORKS.md` (flows), `documentation/OAO/APPENDIX-A-COMPLETE-ROUTE-TABLE.md` (exact mount order), `documentation/OAO/20-AUDIT.md` (audit scopes + taxonomy).

**Maintenance:** POS cart paths are derived from `backend/routes/pos.routes.js` (search for `'/carts`); register paths from `pos-register.routes.js`. When you add routes, update this file and Appendix A.

**In-house API explorer (Admin):** **Developers → API reference book** (`/admin/api-reference`) reads `frontend/src/data/apiEndpointsCatalog.json`, which is **generated from this file** by `node scripts/build-api-catalog.mjs` (also runs as **`npm run prebuild`** in `frontend/`). Keep this markdown complete to keep the explorer complete.

**Static HTML (OAO):** `documentation/OAO/api-explorer.html` — same catalog, browsable offline; regenerated by the same script (also `node scripts/build-api-explorer-html.mjs` after JSON exists). Linked from `documentation/OAO/index.html` under Appendices.

**How to read:** Full path = **base** + **path**. Base is the mount in `server.js` (e.g. `/api/pos`). Path is the route string (e.g. `/carts`). So `GET /api/pos/carts` = base `/api/pos` + path `/carts`.

---

1. Auth — base `/api/auth`

Base: /api/auth

Method	Path	Notes
POST	`/api/auth/login`	Platform login (email + password)
POST	`/api/auth/logout`	requireSessionAuth
GET	`/api/auth/me`	requireSessionAuth
POST	`/api/auth/refresh`	requireSessionAuth
POST	`/api/auth/forgot-password`	Public
POST	`/api/auth/reset-password`	Public
GET	`/api/auth/status`	Session/tenant status (optional auth)

2. POS — base `/api/pos`

Base: /api/pos

**Parent mount:** `requireSessionAuth`, `tenantResolver` on both routers; **pos.routes.js** also has **`optionalDeviceAuth`**. **pos.routes.js** exports router as `r` and applies **idempotency** middleware to mutating cart routes.
### 2a. Carts, catalog, device settings (`pos.routes.js`)
### 2b. Register / shift (`pos-register.routes.js`, same base)

Method	Path	Notes
GET	`/api/pos/carts`	List carts
POST	`/api/pos/carts`	Create cart (dedicated rate limiter)
GET	`/api/pos/carts/:id`	Get cart + linked crypto invoice if present
POST	`/api/pos/carts/:id/send-to-kitchen`	Manual KDS ticket for cart
PUT	`/api/pos/carts/:id/customer`	Attach customer (preferred)
POST	`/api/pos/carts/:id/customer`	Deprecated; backward compat
GET	`/api/pos/carts/:id/invoice`	Poll crypto invoice linked to cart
POST	`/api/pos/carts/:id/items`	Add line items
POST	`/api/pos/carts/:id/items/:lineId/qty`	Set quantity for one line
DELETE	`/api/pos/carts/:id/items/:lineId`	Remove line
POST	`/api/pos/carts/:id/recalc`	Recalc tax/discount
POST	`/api/pos/carts/:id/tip`	Set tip
POST	`/api/pos/carts/:id/tender/cash`
POST	`/api/pos/carts/:id/tender/card`
POST	`/api/pos/carts/:id/tender/giftcard`
POST	`/api/pos/carts/:id/tender/loyalty`
POST	`/api/pos/carts/:id/tender/crypto`	Crypto (e.g. DOGE/LTC)
POST	`/api/pos/carts/:id/tender/coinbase`
POST	`/api/pos/carts/:id/tender/coingate`
POST	`/api/pos/carts/:id/tender/stripe-terminal`
POST	`/api/pos/carts/:id/tender/square-terminal`
POST	`/api/pos/carts/:id/tender/ingenico`
POST	`/api/pos/carts/:id/tender/verifone`
POST	`/api/pos/carts/:id/tender/adyen`
POST	`/api/pos/carts/:id/tender/paypal`
POST	`/api/pos/carts/:id/finalize`	Finalize → invoice
GET	`/api/pos/catalog`	Unified catalog
GET	`/api/pos/settings`	Device row, catalogs, `posModules`, `fuelSite`
POST	`/api/pos/settings/assign-catalog`
POST	`/api/pos/settings/assign-location`
GET	`/api/pos/settings/available-catalogs`
GET	`/api/pos/settings/available-locations`
POST	`/api/pos/register/authenticate`	Email + POS PIN → staff JSON
POST	`/api/pos/register/open`	Body: `deviceKey`, `openingFloatCents`, optional `staffId`
GET	`/api/pos/register/status`	Query: `device_key` / `deviceKey`, optional `staff_id` / `staffId`
POST	`/api/pos/register/close`
GET	`/api/pos/register/open-shifts`	Admin list
GET	`/api/pos/register/shift-history`
POST	`/api/pos/register/admin-close`	Manager close other device
POST	`/api/pos/register/admin-force-signout`	Manager force sign-out

3. Devices — base `/api/devices` (api/devices/index.js)

Base: /api/devices

Method	Path	Notes
GET	`/api/devices/`	List devices
GET	`/api/devices/active`	Active (heartbeat) devices
GET	`/api/devices/:id`	Get device
POST	`/api/devices/`	Create device
PUT	`/api/devices/:id`	Update device
DELETE	`/api/devices/:id`	Delete device
POST	`/api/devices/heartbeat`	Device heartbeat (auto-register)
POST	`/api/devices/:id/heartbeat`	Legacy heartbeat by ID
GET	`/api/devices/profiles`	Device profiles
POST	`/api/devices/profiles`	Create profile
GET	`/api/devices/printers`	Printers
POST	`/api/devices/printers`	Add printer
GET	`/api/devices/codes`	Device codes
POST	`/api/devices/codes`	Create code
POST	`/api/devices/codes/:code/claim`	Claim code
GET	`/api/devices/analytics`	Device analytics

4. Bridge — base `/api`

Base: /api

**WebSocket:** `ws://host/api/bridges/connect?bridgeId=...&tenantSlug=...` (no HTTP method).

Method	Path	Notes
GET	`/api/bridge/status`	requireSessionAuth, tenantResolver
POST	`/api/bridge/config`
POST	`/api/bridge/test`
POST	`/api/bridge/token`
GET	`/api/bridge/token`
GET	`/api/bridge/config-file`
POST	`/api/bridge/notify-device`	Notify device (fire-and-forget to C# bridge)

5. Users — base `/api/users`

Base: /api/users

Method	Path	Notes
GET	`/api/users/profile`
PUT	`/api/users/profile`
POST	`/api/users/change-password`
GET	`/api/users/preferences`
PUT	`/api/users/preferences`
GET	`/api/users/feature-modules`
PUT	`/api/users/feature-modules`
GET	`/api/users/permissions`
PUT	`/api/users/permissions`
GET	`/api/users/role`
PUT	`/api/users/role`
GET	`/api/users/tenant`
POST	`/api/users/switch-tenant`

6. Staff — base `/api/staff`

Base: /api/staff

**Feature gate:** staff_hr. **Auth:** requireFlexibleAuth, tenantResolver.

Method	Path	Notes
GET	`/api/staff/`	List staff
GET	`/api/staff/:id`	Get staff
POST	`/api/staff/`	Create staff
PUT	`/api/staff/:id`	Update staff
DELETE	`/api/staff/:id`	Delete staff
GET	`/api/staff/profile`	Current staff profile
POST	`/api/staff/register`	Register staff (e.g. device account)

7. HR — base `/api/hr`

Base: /api/hr

**Feature gate:** staff_hr. Sub-routers: employees, departments, benefits, timeOff, reports, payrollRunManager, security, businessTaxInfo, taxRates, payrollCalculation, payrollRuns.

Method	Path	Notes
POST	`/api/hr/timeclock/clock-in`
POST	`/api/hr/timeclock/clock-out`
POST	`/api/hr/timeclock/break-start`
POST	`/api/hr/timeclock/break-end`
GET	`/api/hr/timesheets`
GET	`/api/hr/timesheets/:id`
POST	`/api/hr/timesheets/:id/approve`
POST	`/api/hr/payroll/runs`
GET	`/api/hr/payroll/runs`
POST	`/api/hr/payroll/runs/:id/approve`
POST	`/api/hr/payroll/runs/:id/process`
POST	`/api/hr/schedules`
GET	`/api/hr/schedules`
PUT	`/api/hr/schedules/:id`
DELETE	`/api/hr/schedules/:id`
POST	`/api/hr/reviews`
GET	`/api/hr/reviews`
PUT	`/api/hr/reviews/:id`
GET	`/api/hr/reports`
GET	`/api/hr/reports/attendance`
GET	`/api/hr/reports/payroll`
GET	`/api/hr/reports/performance`
GET	`/api/hr/employees`
GET	`/api/hr/employees/:id`
POST	`/api/hr/employees`
PUT	`/api/hr/employees/:id`
POST	`/api/hr/employees/:id/terminate`
POST	`/api/hr/employees/sync-from-staff/:staffId`
GET	`/api/hr/employees/:id/w4`
POST	`/api/hr/employees/:id/w4`
GET	`/api/hr/employees/:id/i9`
POST	`/api/hr/employees/:id/i9`
GET	`/api/hr/employees/:id/compensation`
POST	`/api/hr/employees/:id/compensation`
GET	`/api/hr/employees/:id/time-off`
GET	`/api/hr/departments`
GET	`/api/hr/departments/:id`
POST	`/api/hr/departments`
PUT	`/api/hr/departments/:id`
DELETE	`/api/hr/departments/:id`
POST	`/api/hr/departments/:id/assign-employee`
GET	`/api/hr/departments/:id/employees`
GET	`/api/hr/departments/:id/analytics`
GET	`/api/hr/benefits/plans`
GET	`/api/hr/benefits/plans/:id`
POST	`/api/hr/benefits/plans`
PUT	`/api/hr/benefits/plans/:id`
DELETE	`/api/hr/benefits/plans/:id`
POST	`/api/hr/benefits/enrollments`
GET	`/api/hr/benefits/enrollments/:id`
GET	`/api/hr/benefits/employees/:employeeId`
PUT	`/api/hr/benefits/enrollments/:id`
POST	`/api/hr/benefits/enrollments/:id/cancel`
GET	`/api/hr/benefits/summary`
GET	`/api/hr/benefits/enrollment-status`
POST	`/api/hr/time-off/request`
GET	`/api/hr/time-off/requests`
GET	`/api/hr/time-off/balance`
GET	`/api/hr/time-off/balances`
POST	`/api/hr/time-off/:requestId/approve`
POST	`/api/hr/time-off/:requestId/reject`
POST	`/api/hr/time-off/:requestId/cancel`
GET	`/api/hr/time-off/team`
GET	`/api/hr/time-off/calendar`
GET	`/api/hr/reports/payroll-trends`
GET	`/api/hr/reports/department-hours`
GET	`/api/hr/reports/overtime-by-department`
GET	`/api/hr/reports/employee-costs`
GET	`/api/hr/reports/tax-liability`
GET	`/api/hr/reports/tax-filing-status`
POST	`/api/hr/reports/custom`
GET	`/api/hr/reports/export/:reportType`
POST	`/api/hr/payroll/run-manager/initialize`
GET	`/api/hr/payroll/run-manager/:runId/step/:step`
PUT	`/api/hr/payroll/run-manager/:runId/step/:step`
GET	`/api/hr/payroll/run-manager/:runId/validate`
POST	`/api/hr/payroll/run-manager/:runId/finalize`
DELETE	`/api/hr/payroll/run-manager/:runId`
POST	`/api/hr/security/:employeeId/reset-password`
POST	`/api/hr/security/:employeeId/reset-pos-pin`
POST	`/api/hr/security/:employeeId/set-pos-pin`

8. Storefront — base `/api/storefront`

Base: /api/storefront

Method	Path	Notes
GET	`/api/storefront/:tenantSlug/config`	Public (no auth)
GET	`/api/storefront/config`	requireSessionAuth, tenantResolver
PUT	`/api/storefront/config`
DELETE	`/api/storefront/:tenantSlug/carts/:cartId/items/:lineId`
GET	`/api/storefront/:tenantSlug/menu-items`

9. Public & signup — base `/api/public`

Base: /api/public

**Sibling mount:** `GET /api/public/barcode-lookup` — see §31 (rate-limited guest catalog lookup; not under `/api/public/*` path prefix in table above).

Method	Path	Notes
GET	`/api/public/test`
POST	`/api/public/test`
POST	`/api/public/signup`	Signup (creates org, tenant, user + provisioning)
GET	`/api/public/tenant/:slug`	Get tenant info (public)

10. Employee portal — base `/api/employee-portal`

Base: /api/employee-portal

**Auth:** None for login; session token for other routes.

Method	Path	Notes
GET	`/api/employee-portal/test`
POST	`/api/employee-portal/login`	identifier + credential (employeeResolver)
(other)	`/api/employee-portal/pay-stubs, /info, /tax-forms, /bank-accounts, etc.`	See hr/employeePortal.routes.js

11. Tenant-staff auth — base `/api/tenant-staff-auth`

Base: /api/tenant-staff-auth

Used for POS/staff login without platform session (tenant from body/header).

No tabulated endpoints in this section.

12. Crypto config — base `/api`

Base: /api

Method	Path	Notes
GET	`/api/crypto-config`
GET	`/api/crypto-config/scan-nodes`
POST	`/api/crypto-config`
POST	`/api/crypto-config/test-connection`

13. Core invoicing — base `/api/core-invoicing`

Base: /api/core-invoicing

Method	Path	Notes
POST	`/api/core-invoicing/invoice`
POST	`/api/core-invoicing/payment`
POST	`/api/core-invoicing/pos-sale`
POST	`/api/core-invoicing/kiosk-order`
POST	`/api/core-invoicing/crypto-invoice`
POST	`/api/core-invoicing/service-ticket`
POST	`/api/core-invoicing/inventory-adjustment`
GET	`/api/core-invoicing/sales-analytics`
GET	`/api/core-invoicing/inventory-analytics`
POST	`/api/core-invoicing/void-invoice`
POST	`/api/core-invoicing/refund-invoice`

14. Invoices — base `/api/invoices`

Base: /api/invoices

Method	Path	Notes
GET	`/api/invoices/`	List
POST	`/api/invoices/`	Create
GET	`/api/invoices/:id`	Get
PUT	`/api/invoices/:id`	Update
POST	`/api/invoices/:id/payments`	Add payment

15. Receipts — base `/api/receipts`

Base: /api/receipts

Method	Path	Notes
GET	`/api/receipts/view/:token`	Public view by token
GET	`/api/receipts/templates/current`
PUT	`/api/receipts/templates/current`
POST	`/api/receipts/preview`
GET	`/api/receipts/preview/:invoiceId`
POST	`/api/receipts/:invoiceId/email`
POST	`/api/receipts/:invoiceId/sms`
POST	`/api/receipts/send`

16. Catalog (admin) — base `/api/admin/catalog`

Base: /api/admin/catalog

**Router:** catalog.routes.NEW.js, adminCatalogAssignments.router.js.

Method	Path	Notes
GET	`/api/admin/catalog/catalogs`
GET	`/api/admin/catalog/catalogs/:id`
POST	`/api/admin/catalog/catalogs`
PUT	`/api/admin/catalog/catalogs/:id`
DELETE	`/api/admin/catalog/catalogs/:id`
POST	`/api/admin/catalog/catalogs/:id/items`
GET	`/api/admin/catalog/menus`
GET	`/api/admin/catalog/menus/:id`
POST	`/api/admin/catalog/menus`
DELETE	`/api/admin/catalog/menus/:id`
GET	`/api/admin/catalog/menu-assignments`
POST	`/api/admin/catalog/menu-assignments`
DELETE	`/api/admin/catalog/menu-assignments/:id`
GET	`/api/admin/catalog/preparables`
GET	`/api/admin/catalog/preparables/:id`
POST	`/api/admin/catalog/preparables`
DELETE	`/api/admin/catalog/preparables/:id`
POST	`/api/admin/catalog/preparables/:id/attach`
GET	`/api/admin/catalog/assignments`	Catalog assignments
GET	`/api/admin/catalog/assignments/:id`
POST	`/api/admin/catalog/assignments`
PUT	`/api/admin/catalog/assignments/:id`
DELETE	`/api/admin/catalog/assignments/:id`

17. Devices (admin) — base `/api/admin`

Base: /api/admin

**Router:** devices.routes.js (locations + devices CRUD).

Method	Path	Notes
GET	`/api/admin/locations`
POST	`/api/admin/locations`
PUT	`/api/admin/locations/:id`
DELETE	`/api/admin/locations/:id`
GET	`/api/admin/devices`
GET	`/api/admin/devices/:id`
POST	`/api/admin/devices`
PUT	`/api/admin/devices/:id`
DELETE	`/api/admin/devices/:id`
POST	`/api/admin/devices/:id/assign`
DELETE	`/api/admin/devices/:id/assign/:catalogId`

18. KDS — base `/api/kds`

Base: /api/kds

**Feature gate:** kds. **Router:** `backend/routes/kds.routes.js`.
### 18.1 Admin KDS — base `/api/admin/kds`
**Feature gate:** kds. **Router:** `backend/routes/admin.kds.routes.js`. **Service:** `backend/services/kdsOps.service.js` (tenant tables `kds_ops_settings`, `kds_category_routing`).

Method	Path	Notes
GET	`/api/kds/orders`	Query: `lane` (FIRE\ — PREP\ — FUTURE\ — DONE), optional `station`, `limit`; header `X-Device-ID` updates device heartbeat
GET	`/api/kds/devices/status`	KDS-capable devices and status
POST	`/api/kds/orders/:id/bump`	Lane → DONE
POST	`/api/kds/orders/:id/recall`	Lane → FIRE
POST	`/api/kds/orders/:id/print`	Stub
POST	`/api/kds/ingest`	Test / integration ingest
GET	`/api/kds/config`	Settings + routing rows + distinct product categories
PATCH	`/api/kds/settings`	Body: `autoSendUpdates`, `combineIdenticalItems`, `useRoutingCategories`
PUT	`/api/kds/routing`	Body: `categoryKey`, `station` (upsert; category key normalized)
DELETE	`/api/kds/routing/:categoryKey`	Remove mapping
POST	`/api/kds/routing/auto-assign`	Body: `defaultStation` (e.g. `main`) — seed rows per distinct category

18a. Kiosk — base `/api/kiosk`

Base: /api/kiosk

**Auth:** tenantResolver + deviceAuth (device credentials required).
**Router:** backend/routes/api/kiosk/index.js. Used by kiosk UI for cart and checkout (no cash).

Method	Path	Notes
GET	`/api/kiosk/health`	Health check (deviceId, orgId in response)
POST	`/api/kiosk/carts`	Create cart (body: customerId?, items?, metadata)
PUT	`/api/kiosk/carts/:id`	Update cart (body: items, customerId?, metadata?)
POST	`/api/kiosk/carts/:id/checkout`	Finalize cart → invoice (tenders: non-cash only; uses InvoiceService.createFromCart, source: kiosk)

18b. Mobile — base `/api/mobile`

Base: /api/mobile

**Auth:** tenantResolver + deviceAuth.
**Router:** backend/routes/api/mobile/index.js. Offline-ready cart flow; sync/finalize by localCartId.

Method	Path	Notes
POST	`/api/mobile/carts`	Create cart (body: customerId?, items?, localCartId?; metadata.surface: mobile)
POST	`/api/mobile/carts/:localCartId/sync`	Sync cart items (body: cartId, items) — stub that updates by cartId
POST	`/api/mobile/carts/:localCartId/finalize`	Finalize to invoice (body: cartId, tenders?; uses InvoiceService.createFromCart, source: mobile)

19. Tickets — base `/api/tickets`

Base: /api/tickets

Method	Path	Notes
GET	`/api/tickets/_ping`
GET	`/api/tickets/_debug`
GET	`/api/tickets/`	List
POST	`/api/tickets/`	Create
PUT	`/api/tickets/:id`	Update
GET	`/api/tickets/:id/bill`
POST	`/api/tickets/:id/bill/items`
POST	`/api/tickets/:id/bill/add-item`
POST	`/api/tickets/:id/bill/remove-item`
POST	`/api/tickets/:id/bill/clear`
POST	`/api/tickets/:id/bill/checkout`
POST	`/api/tickets/:id/bill/mark-paid`
POST	`/api/tickets/:id/invoice`
GET	`/api/tickets/:id/invoice`
POST	`/api/tickets/:id/tender/cash`
POST	`/api/tickets/:id/tender/card`
POST	`/api/tickets/:id/tender/giftcard`
POST	`/api/tickets/:id/tender/loyalty`
POST	`/api/tickets/:id/finalize`
GET	`/api/tickets/templates`
GET	`/api/tickets/templates/:templateId`
POST	`/api/tickets/from-template`
PUT	`/api/tickets/:id/custom-fields`
PUT	`/api/tickets/:id/billing`
GET	`/api/tickets/analytics`

20. Gift cards — base `/api/giftcards`

Base: /api/giftcards

**Feature gate:** gift_cards. Router uses `r` (path is relative to mount).

Method	Path	Notes
POST	`/api/giftcards/`	Create
GET	`/api/giftcards/`	List (with filters)
GET	`/api/giftcards/:id`	Get
PUT	`/api/giftcards/:id`	Update
POST	`/api/giftcards/:id/activate`
POST	`/api/giftcards/:id/reload`
POST	`/api/giftcards/balance`	Check balance (code)
POST	`/api/giftcards/redeem`	Redeem (code, amount)

21. Loyalty — base `/api`

Base: /api

**Router:** loyalty.routes.js (mounted at /api, paths include /loyalty).

Method	Path	Notes
POST	`/api/loyalty/grant`	Grant points
POST	`/api/loyalty/redeem`	Redeem points

22. Reports — base `/api/reports`

Base: /api/reports

Method	Path	Notes
GET	`/api/reports/test`
GET	`/api/reports/ (or /summary)`
GET	`/api/reports/sales/summary`
GET	`/api/reports/sales/items`
GET	`/api/reports/sales/trends`
GET	`/api/reports/sales/categories`
GET	`/api/reports/sales/teams`
GET	`/api/reports/sales/modifiers`
GET	`/api/reports/sales/gift-cards`
GET	`/api/reports/sales/vendors`
GET	`/api/reports/payments/methods`
GET	`/api/reports/payments/statuses`
GET	`/api/reports/payments/discounts`
GET	`/api/reports/payments/comps`
GET	`/api/reports/payments/voids`
GET	`/api/reports/payments/cash-drawers`
GET	`/api/reports/accounting/taxes`
GET	`/api/reports/accounting/fees`
GET	`/api/reports/accounting/service-charges`
GET	`/api/reports/accounting/reconciliation`
GET	`/api/reports/operations/activity`
GET	`/api/reports/operations/labor`
GET	`/api/reports/operations/kitchen`
GET	`/api/reports/inventory/cogs`
GET	`/api/reports/inventory/category`
GET	`/api/reports/inventory/projected-profit`
GET	`/api/reports/inventory/sell-through`
GET	`/api/reports/inventory/aging`

23. Transactions — base `/api/transactions`

Base: /api/transactions

Method	Path	Notes
GET	`/api/transactions/list`
GET	`/api/transactions/:id`

24. Payment providers — base `/api/payment-providers`

Base: /api/payment-providers

Method	Path	Notes
GET	`/api/payment-providers/`	List
GET	`/api/payment-providers/:id`	Get
POST	`/api/payment-providers/`	Create
PUT	`/api/payment-providers/:id`	Update
DELETE	`/api/payment-providers/:id`	Delete
POST	`/api/payment-providers/:id/test`
(others)	`/api/payment-providers/(see paymentProviders.routes.js)`

25. Offline transactions — base `/api/offline-transactions`

Base: /api/offline-transactions

Method	Path	Notes
GET	`/api/offline-transactions/`	List
GET	`/api/offline-transactions/:id`	Get
POST	`/api/offline-transactions/`	Create / upload
POST	`/api/offline-transactions/:id/sync`
DELETE	`/api/offline-transactions/:id`

26. V1 API (payments) — base `/api/v1`

Base: /api/v1

**Routers:** v1/index.js (health, auth, tenants, pos, etc.) + payments/api/v1/*.

Method	Path	Notes
GET	`/api/v1/health`
GET	`/api/v1/status`
(auth)	`/api/v1/auth/*`	From authRouter
(tenants)	`/api/v1/tenants/*`	requireSessionAuth, tenantResolver
(master-admin)	`/api/v1/master-admin/*`
(pos)	`/api/v1/pos/*`	requireSessionAuth, tenantResolver
GET	`/api/v1/transactions`	List
GET	`/api/v1/transactions/:id`	Get
POST	`/api/v1/transactions/:id/refund`
POST	`/api/v1/transactions/:id/void`
POST	`/api/v1/crypto/invoices`
GET	`/api/v1/crypto/invoices/:id`
GET	`/api/v1/recon/now`
GET	`/api/v1/merchants/me`
POST	`/api/v1/merchants/api_keys`
GET	`/api/v1/merchants/api_keys`
DELETE	`/api/v1/merchants/api_keys/:id`
POST	`/api/v1/merchants/api_keys/:keyId/revoke`
POST	`/api/v1/merchants/api_keys/:id/rotate`
GET	`/api/v1/locations`
POST	`/api/v1/locations`
PATCH	`/api/v1/locations/:id`
DELETE	`/api/v1/locations/:id`
GET	`/api/v1/ledger/accounts`
GET	`/api/v1/ledger/txns`
GET	`/api/v1/keys`
POST	`/api/v1/keys`
GET	`/api/v1/keys/:keyId`
POST	`/api/v1/keys/:keyId/rotate`
POST	`/api/v1/keys/:keyId/revoke`
GET	`/api/v1/webhooks/endpoints`
POST	`/api/v1/webhooks/endpoints`
POST	`/api/v1/webhooks/endpoints/:id/enable`
POST	`/api/v1/webhooks/endpoints/:id/disable`
DELETE	`/api/v1/webhooks/endpoints/:id`
POST	`/api/v1/webhooks/endpoints/:id/rotate`
POST	`/api/v1/webhooks/endpoints/:id/ping`
GET	`/api/v1/webhooks/deliveries`
POST	`/api/v1/webhooks/deliveries/:id/redeliver`
POST	`/api/v1/webhooks/endpoints/:id/test`
POST	`/api/v1/payment_intents`
POST	`/api/v1/payment_intents/:id/confirm`
POST	`/api/v1/payment_intents/:id/capture`
POST	`/api/v1/payments/intents`
POST	`/api/v1/payments/intents/capture`
POST	`/api/v1/payments/intents/void`
POST	`/api/v1/payments/intents/refund`
POST	`/api/v1/payments`
GET	`/api/v1/payments/:id`
GET	`/api/v1/disputes`
POST	`/api/v1/disputes`
GET	`/api/v1/disputes/:id`
PATCH	`/api/v1/disputes/:id`
POST	`/api/v1/disputes/:id/timeline`
POST	`/api/v1/disputes/:id/evidence`
GET	`/api/v1/api_keys`
POST	`/api/v1/api_keys`
POST	`/api/v1/api_keys/:id/rotate`
POST	`/api/v1/api_keys/:id/revoke`
(invoices)	`/api/v1/POST/GET (see v1/invoices.routes.js)`
(utxo)	`/api/v1/POST (see v1/utxo.routes.js)`
(org rules)	`/api/v1/GET/PATCH (see v1/org.rules.routes.js)`

27. Webhooks (raw body, no session)

Method	Path	Notes
POST	`/api/webhooks/stripe`	Stripe signature verification
POST	`/api/webhooks/coinbase`	Coinbase
POST	`/api/webhooks/coinremitter`	Coinremitter
POST	`/api/webhooks/doge`	Doge wallet notify
POST	`/api/webhooks/ltc`	LTC wallet notify
*	`/api/webhooks/generic`	Generic webhooks

28. Signage — base `/api/signage`

Base: /api/signage

**Router:** `signage.routes.js`. **Public:** playlist only. **Admin:** `requireSessionAuth`, `tenantResolver`, tenant main DB (`SignageFolders`, `SignageAds`, `SignageDisplays`).

Method	Path	Notes
GET	`/api/signage/playlist/:tenantSlug/:displaySlug`	Public — JSON playlist for TV player
GET	`/api/signage/folders`	List folders
POST	`/api/signage/folders`	Create folder
PUT	`/api/signage/folders/:id`	Update folder
DELETE	`/api/signage/folders/:id`	Delete folder
GET	`/api/signage/ads`	List ads (optional `folderId` query)
POST	`/api/signage/ads`	Create ad
PUT	`/api/signage/ads/:id`	Update ad
DELETE	`/api/signage/ads/:id`	Delete ad
GET	`/api/signage/displays`	List displays
POST	`/api/signage/displays`	Create display
PUT	`/api/signage/displays/:id`	Update display
DELETE	`/api/signage/displays/:id`	Delete display

29. Audit — base `/api/audit`

Base: /api/audit

**Router:** `audit.routes.js`. **Auth:** `requireSessionAuth`, `tenantResolver`; each handler **`requireScopes`** (`audit:read` or `audit:write`). **Storage:** tenant analytics DB `audit_logs`. **Taxonomy:** `backend/constants/auditTaxonomy.js`.

Method	Path	Notes
GET	`/api/audit/taxonomy`	audit:read — `categories`, `eventTypes`, `entityTypes`, `filterPresets`
POST	`/api/audit/record`	audit:write — Record event
GET	`/api/audit/logs`	audit:read — Filtered logs
GET	`/api/audit/summary/event-type`	audit:read — Requires date range
GET	`/api/audit/summary/user`	audit:read — Requires date range
GET	`/api/audit/security`	audit:read — Requires date range
GET	`/api/audit/data-access`	audit:read — Requires date range
GET	`/api/audit/financial`	audit:read — Requires date range
GET	`/api/audit/compliance`	audit:read — Requires date range
POST	`/api/audit/entity-trail`	audit:write —
GET	`/api/audit/export`	audit:read — JSON/CSV

30. Platform catalog — base `/api/platform-catalog`

Base: /api/platform-catalog

**Router:** `platformCatalog.routes.js`. **Auth:** `requireSessionAuth`, `tenantResolver`. Session-based product enrichment for POS/inventory (not the guest public lookup).
**Static:** `/media/platform-catalog` may serve catalog images when configured (`server.js`).

Method	Path	Notes
GET	`/api/platform-catalog/lookup`	Query `barcode` — master platform catalog row

31. Public guest barcode — base `/api/public/barcode-lookup`

Base: /api/public/barcode-lookup

**Router:** `public.barcodeLookup.routes.js`. **Auth:** none; **strict per-IP rate limit** (`PUBLIC_BARCODE_LOOKUP_*` env). Marketing / anonymous use; tenants use §30 in-app.

Method	Path	Notes
GET	`/api/public/barcode-lookup/`	Query `q` (preferred) or `barcode` — exact GTIN or search

32. Staff permissions — base `/api/staff-permissions`

Base: /api/staff-permissions

**Router:** `staffPermissions.routes.js` (mounted via `api/index.js` at `/api`). **Auth:** `requireSessionAuth`, `tenantResolver`, **`requireRoles`** (varies per route).

Method	Path	Notes
GET	`/api/staff-permissions/initialize`	admin
GET	`/api/staff-permissions/permissions`	admin, manager, master_admin
GET	`/api/staff-permissions/roles`	admin, manager, master_admin
GET	`/api/staff-permissions/staff/:staffId`	admin, manager, master_admin
POST	`/api/staff-permissions/staff/:staffId/assign-role`	admin
DELETE	`/api/staff-permissions/staff/:staffId/remove-role/:role`	admin
GET	`/api/staff-permissions/check/:staffId/:permission`	admin, manager, master_admin
GET	`/api/staff-permissions/staff-with-role/:role`	admin, manager, master_admin
GET	`/api/staff-permissions/my-permissions`	Session staff

33. Other notable prefixes (summary)

**/api/products, /api/categories, /api/modifiers, /api/orders** — CRUD (requireSessionAuth, tenantResolver).
**/api/customers** — customersRouter (main DB).
**/api/profiles** — Printer/mode profiles.
**/api/time, /api/tenant-time, /api/team-hours, /api/staff-personal** — Time clock, roster, payroll.
**/api/dashboard, /api/business-hub** — Dashboard and hub.
**/api/inventory, /api/inventory/items|domains|ledger|rules** — Inventory (feature gate).
**/api/pos-analytics, /api/customer-analytics** — Analytics.
**/api/plans, /api/features** — Plans and feature flags (public or minimal auth).
**/api/tenants** — Tenant info (session).
**/api/master-admin, /api/master-admin/tenants** — Master admin + provisioning.
**/api/admin/payments, /api/admin/orgs, /api/admin/programs, /api/admin/liability** — Admin.
**/api/tax-settings, /api/branding-settings** — Via apiRouter.
**/api/recipes, /api/seating-layouts, /api/kitchen-domains, /api/menu-items** — Menus/kitchen.
**/api/appointments** — Appointments (feature gate).
**/api/admin/tickets, /api/admin/ticket-settings, /api/admin/ticket-workflows, /api/admin/email-templates** — Ticket admin.
**/api/simple** — Simple transactions/customers (minimal auth).
**/api/assignees** — Assignees.
**/api/crypto-wallet, /api/rates** — Crypto.
**/api/maintenance, /api/bi, /api/billing, /api/financial** — Maintenance/BI/billing.
**/api/developer** — Developer tools.
**/api/idempotency, /api/session-management, /api/user-management** — Session/idempotency/user.
**/api/audit** — Full table §29; **/api/signage** §28; **/api/platform-catalog** §30; **/api/public/barcode-lookup** §31; **/api/staff-permissions** §32.
**/api/device-catalog** — Device catalog (terminals, printers).
**/api/giftcard** — Gift card (single; different from giftcards).
**/api/crypto-prices** — Public crypto prices.
**/customer/** — Public customer (publicCustomerRouter).

No tabulated endpoints in this section.