Appendix — Complete Backend Route Table
CEO Summary
Routes are matched in order. Earlier mounts take precedence. Webhooks have no auth (external callers). Most API routes require session + tenant. If order changes: Requests may hit wrong handler.
Route Mount Order
| # | Path | Middleware | Router |
|---|---|---|---|
| 1 | /api/webhooks/stripe | (none) | stripeWebhook |
| 2 | /api/webhooks/coinbase | (none) | coinbaseWebhook |
| 3 | /api/webhooks/coinremitter | (none) | coinremitterWalletWebhook |
| 4 | /api/users | requireSessionAuth, tenantResolver | usersRouter |
| 5 | /api/file-structure | requireSessionAuth (dev) / 403 (prod) | fileStructureRouter |
| 6 | /api/public | (none) | publicTicketsRouter |
| 7 | /api/public/appointments | (none) | publicAppointmentsRouter |
| 8 | /api/public | (none) | publicSignupRouter |
| 9 | /api/staff-auth | (none) | staffAuthRouter |
| 10 | /api/employee-portal | (none) | employeePortalRouter |
| 11 | /api/auth, /auth | (none) | authRouter |
| 12 | /api/auth/oauth | (none) | oauthRouter |
| 14 | /api/products | requireSessionAuth, tenantResolver | productsRouter |
| 15 | /api/categories | requireSessionAuth, tenantResolver | categoriesRouter |
| 16 | /api/modifiers | requireSessionAuth, tenantResolver | modifiersRouter |
| 17 | /api/orders | requireSessionAuth, tenantResolver | ordersRouter |
| 18 | /api/pos | requireSessionAuth, tenantResolver, optionalDeviceAuth | posRouter |
| 19 | /api/pos | requireSessionAuth, tenantResolver | posRegisterRouter |
| 20 | /api/pos-analytics | requireSessionAuth, tenantResolver | posAnalyticsRouter |
| 21 | /api/transaction-tracking | requireSessionAuth, tenantResolver | transactionTrackingRouter |
| 22 | /api/inventory-management | requireSessionAuth, tenantResolver, checkFeatureAccess('inventory') | inventoryManagementRouter |
| 23 | /api/customers | requireSessionAuth, tenantResolver | customersRouter |
| 24 | /api/storefront | (none) | storefrontRouter |
| 25 | /api/customer-analytics | (none) | customerAnalyticsRouter |
| 26 | /api/profiles | requireSessionAuth, tenantResolver | profilesRouter |
| 27 | /api/staff | requireFlexibleAuth, tenantResolver, checkFeatureAccess('staff_hr') | staffRouter |
| 28 | /api/time | requireFlexibleAuth, tenantResolver, checkFeatureAccess('staff_hr') | timeRouter |
| 29 | /api/tenant-staff-auth | (none) | tenantStaffAuthRouter |
| 30 | /api/tenant-time | tenantResolver | tenantTimeRouter |
| 31 | /api/team-hours | requireSessionAuth, tenantResolver | teamHoursRouter |
| 32 | /api/staff-personal | (none) | staffPersonalRouter |
| 33 | /api/core-invoicing | requireSessionAuth, tenantResolver | coreInvoicingRouter |
| 34 | /api/business-hub | requireSessionAuth, tenantResolver | businessHubRouter |
| 35 | /api/dashboard | requireSessionAuth, tenantResolver | dashboardRouter |
| 36 | /api/master-admin | (none) | masterAdminRouter |
| 37 | /api/payroll | requireSessionAuth, tenantResolver, checkFeatureAccess('staff_hr') | payrollRouter |
| 38–42 | /api/inventory/* | requireSessionAuth, tenantResolver, checkFeatureAccess('inventory') | inventoryRouter, items, domains, ledger, rules |
| 43 | /api/email | requireSessionAuth, tenantResolver | emailRouter |
| 44 | /api/catalog/permissions | requireSessionAuth, tenantResolver | catalogPermissionsRouter |
| 45 | /api/payments | (none, if ENABLE_LEGACY_3P) | legacyPaymentsRouter |
| 46 | /api/v1/* | (none) | v1Payments, v1Invoices, v1Merchants, v1Locations, v1Webhooks, v1Ledger, v1Keys, v1Transactions, v1OrgRules, v1Recon, v1Utxo, v1Disputes |
| 47 | /api/webhooks/generic | (none) | genericWebhooksRouter |
| 48 | /api | (none) | dogeRouter, ltcRouter |
| 49 | /api/rates | (none) | ratesRouter |
| 50 | /api | (none) | cryptoConfigRouter, bridgeRouter (/bridge/* includes notify-signage) |
| 51 | /api/crypto-wallet | requireSessionAuth, tenantResolver | cryptoWalletRouter |
| 52 | /api | (none) | maintenanceRouter, biRouter, billingRouter, financialRouter |
| 53 | /api/developer | requireSessionAuth, tenantResolver | developerRouter |
| 54 | /api, /admin | (none) | adminRoutes |
| 55 | /api/admin/payments | (none) | adminPaymentsRouter |
| 56 | /api/admin/orgs | (none) | adminOrgsRouter |
| 57 | /api/admin/programs, /admin/programs | requireSessionAuth, tenantResolver, checkFeatureAccess('gift_cards') | adminProgramsRouter |
| 58 | /api/admin/liability | (none) | adminLiabilityRouter |
| 59 | /api/giftcards | checkFeatureAccess('gift_cards') | giftCardsRouter |
| 60 | /api/loyalty | checkFeatureAccess('loyalty') | loyaltyRouter |
| 61 | /api/payment-providers | requireSessionAuth, tenantResolver | paymentProvidersRouter |
| 62 | /api/offline-transactions | requireSessionAuth, tenantResolver | offlineTransactionsRouter |
| 63 | /api/device-catalog | requireSessionAuth, tenantResolver | deviceCatalogRouter |
| 64 | /api/master-admin/tenants | (none) | tenantProvisioningRouter |
| 65 | /api/tenants | requireSessionAuth | tenantsRouter |
| 66 | /api/admin/system | (none) | systemRouter |
| 67 | /api/plans | (none) | plansRouter |
| 68 | /api/hr | (none) | hrRouter, hrSecurityRouter |
| 69 | /api/invoices | (none) | invoicesRouter |
| 70 | /api/simple | (none) | simpleTransactionsRouter, simpleCustomersRouter |
| 71 | /api/unified | requireSessionAuth, tenantResolver | unifiedTransactionsRouter |
| 72 | /api/transactions | requireSessionAuth, tenantResolver | transactionsListRouter |
| 73 | /api/features | (none) | featuresRouter |
| 74 | /api/tenant-database | (none) | tenantDatabaseRouter |
| 75 | /customer | (none) | publicCustomerRouter |
| 76 | /api/kiosk | optionalSessionAuth, tenantResolver, deviceAuth | kioskApiRouter |
| 77 | /api/mobile | optionalSessionAuth, tenantResolver, deviceAuth | mobileApiRouter |
| 78 | /api/dashboard | requireSessionAuth, tenantResolver | reportsDashboard |
| 79 | /api/giftcard | requireSessionAuth, tenantResolver | giftCardRouter |
| 80 | /api | (none) | apiRouter |
| 81 | /api/admin/database | requireSessionAuth, master_admin check | adminDatabaseRouter |
| 82 | /api/admin/catalog | requireSessionAuth, tenantResolver | catalogRouter, adminCatalogAssignments |
| 82b | /api/admin/kds | requireSessionAuth, tenantResolver, checkFeatureAccess('kds') | adminKdsRouter (settings + category routing) |
| 83 | /api/admin | requireSessionAuth, tenantResolver | devicesRouter |
| 84 | /api/device-codes | (none) | deviceCodesRouter |
| 85 | /api/tickets | (none) | ticketsRouter |
| 86 | /api/admin/tickets | (none) | adminTicketsRouter |
| 87 | /api/appointments | requireSessionAuth, tenantResolver, checkFeatureAccess('appointments') | appointmentStaffRouter, appointmentsRouter |
| 88 | /api/admin/ticket-settings | (none) | adminTicketSettingsRouter |
| 89 | /api/admin/ticket-workflows | (none) | adminTicketWorkflowsRouter |
| 90 | /api/admin/email-templates | (none) | adminEmailTemplatesRouter |
| 91 | /api/assignees | (none) | assigneesRouter |
| 92 | /api/receipts | requireSessionAuth, tenantResolver | receiptsRouter |
| 93 | /api/idempotency | requireSessionAuth, tenantResolver | idempotencyRouter |
| 94 | /api/session-management | (none) | sessionManagementRouter |
| 95 | /api/user-management | requireSessionAuth, tenantResolver | userManagementRouter |
| 96 | /api/crypto-prices | (none) | cryptoPricesRouter |
| 97 | /api/reports, /reports | requireSessionAuth, tenantResolver | reportsRouter |
| 98 | /api/audit | requireSessionAuth, tenantResolver; per-route requireScopes | auditRouter |
| 99 | /api/webhooks/doge | (none) | dogeWalletNotify |
| 100 | /api/webhooks/ltc | (none) | ltcWalletNotify |
| 101 | /api/menus, /api/menu-assignments | requireSessionAuth, tenantResolver | catalogRouter |
| 102 | /api/kds | requireSessionAuth, tenantResolver, checkFeatureAccess('kds') | kdsRoutes |
| 103 | /api/recipes | requireSessionAuth, tenantResolver | recipesRouter |
| 104 | /api/seating-layouts | requireSessionAuth, tenantResolver | seatingLayoutsRouter |
| 105 | /api/kitchen-domains | requireSessionAuth, tenantResolver | kitchenDomainsRouter |
| 106 | /api/menu-items | requireSessionAuth, tenantResolver | menuItemsRouter |
| 107 | /api | (none) | devMaintenance |
Notable handlers on mounted routers (detail)
Many business endpoints sit under a single mount row above. Examples that are easy to miss when reading only the mount table:
| Mount | Representative paths | Notes |
|---|---|---|
/api/pos (posRouter) | GET /api/pos/settings, cart CRUD, tender, finalize, catalog | GET /settings returns device.posModules (posModules.js) and device.fuelSite (fuelSite.js) from Devices.metadata — 06, 13. |
/api/admin (devicesRouter) | Device CRUD, heartbeat-related admin flows | UI: /admin/devices/manager (DeviceManager.jsx) for register metadata including posModules. |
/api/audit | GET /taxonomy, GET /logs, POST /record, summaries, GET /export | Vocabulary in backend/constants/auditTaxonomy.js; scopes audit:read / audit:write. Chapter 20. |
Middleware Definitions
- requireSessionAuth — Requires req.session.user and req.session.user.id. Sets req.user. Returns 401 otherwise.
- optionalSessionAuth — Always calls next(). Does not block.
- requireFlexibleAuth — Accepts session or API key or other auth.
- tenantResolver — Resolves req.tenant from session, headers, API key, subdomain, or dev fallback.
- optionalDeviceAuth — Adds device context if device key present; does not block.
- deviceAuth — Requires device authentication for kiosk/mobile API.
- checkFeatureAccess(module) — Checks req.tenant.plan and feature gates. Returns 403 if not allowed.
- requireScopes([...]) — Session/user must include scope claims (e.g.
audit:read,audit:writeon/api/audit/*).
Public Routes (No Auth)
- /api/public/* — Signup, tickets, appointments
- /api/staff-auth/* — Staff portal auth
- /api/employee-portal/* — Employee portal
- /api/webhooks/* — Stripe, Coinbase, CoinRemitter, DOGE, LTC
- /api/storefront/* — Public storefront config
- /api/signage/playlist/:tenantSlug/:displaySlug — Public JSON playlist for signage player (no auth)
- /api/crypto-prices — Public crypto prices
- /api/rates — Exchange rates
- /api/tenant-database/* — Tenant DB ops (may have internal auth)
- /customer/* — Public customer registration/login
- /health, /version, /api/_ping — Health/version