Internal API (SPA & admin)

These endpoints power the Waggish storefront and the Platform Admin / Tenant consoles. They are not part of the public partner API and are not covered by its stability guarantees; partners should use /api/v1.

Generated from the route sources. "Permission" is the role-menu right (nav id) the server enforces for that route; the UI hiding a menu item is only a convenience.

Conventions

Base path: /api. JSON in, JSON out. Errors: { "error": "message", "code": "…", "requestId": "…" }.
Customer auth (B2C): Authorization: Bearer <access token> from /api/auth. Access tokens last 15 minutes; renew with POST /api/auth/refresh { refreshToken } (refresh tokens rotate on every use; reusing an old one revokes the whole session).
Admin auth (Platform & tenant staff): the same scheme via /api/admin/auth. Admin and customer tokens are not interchangeable.
Lockout: 5 consecutive failed sign-ins lock the account for 15 minutes (423 account_locked).
Rate limits: 300 requests/min per IP overall; sign-in, register and refresh are limited to 30 attempts / 15 min; public forms to 10 / hour.
IP rules: /api/admin/* honours the Platform Admin's block/allow IP rules.
Tenant scoping: tenant admins only ever see their own tenant's rows; platform-only routes return 403 to tenant admins.
Secrets: payment-gateway, supplier, SMTP, IMAP and WhatsApp secrets are AES-256-GCM encrypted at rest and never returned; responses expose only hasXxx flags.

Authentication

Method	Path	Auth	Notes
POST	/api/auth/register	public	email, password (≥ 8 chars, letter + number), fullName, mobile?
POST	/api/auth/login	public	returns `token`, `refreshToken`, `expiresIn`, `user`
POST	/api/auth/refresh	refresh token	rotates the refresh token
POST	/api/auth/logout	refresh token	revokes the session
GET	/api/auth/me	customer token	current customer
POST	/api/admin/auth/login	public	staff sign-in; audited
POST	/api/admin/auth/refresh	refresh token
POST	/api/admin/auth/logout	refresh token
GET	/api/admin/auth/me	admin token	includes `permissions`

Security, API access and health

Method	Path	Auth	Permission
GET	/api/admin/audit	admin token · platform only	`audit`
GET	/api/admin/api-access	admin token · platform only	`api-access`
POST/PUT/DELETE	/api/admin/api-access/clients[/:id]	admin token · platform only	`api-access`
POST/PUT	/api/admin/api-access/clients/:id/keys, /keys/:id[/revoke\|/rotate]	admin token · platform only	`api-access`
PUT	/api/admin/api-access/settings	admin token · platform only	`api-access`
GET	/api/admin/api-access/usage	admin token · platform only	`api-access`
GET	/api/admin/api-console	admin token (tenant)	`api-console`
POST	/api/admin/api-console/keys/:id/rotate	admin token (tenant)	`api-console`
GET	/api/health	public

/api/admin

Method	Path	Auth	Permission
GET	/api/admin/subscribers	admin token · platform only	`newsletters`
POST	/api/admin/subscribers	admin token · platform only	`newsletters`
PUT	/api/admin/subscribers/:id	admin token · platform only	`newsletters`
DELETE	/api/admin/subscribers/:id	admin token · platform only	`newsletters`
GET	/api/admin/newsletters	admin token · platform only	`newsletters`
POST	/api/admin/newsletters	admin token · platform only	`newsletters`
PUT	/api/admin/newsletters/:id	admin token · platform only	`newsletters`
DELETE	/api/admin/newsletters/:id	admin token · platform only	`newsletters`
POST	/api/admin/newsletters/:id/send	admin token · platform only	`newsletters`

/api/admin/analytics

Method	Path	Auth	Permission
GET	/api/admin/analytics/popular-destinations	admin token	—

/api/admin/approvers

Method	Path	Auth	Permission
GET	/api/admin/approvers	admin token	—
POST	/api/admin/approvers	admin token	—
PUT	/api/admin/approvers/:id	admin token	—
DELETE	/api/admin/approvers/:id	admin token	—

/api/admin/blogs

Method	Path	Auth	Permission
GET	/api/admin/blogs	public	—
POST	/api/admin/blogs	public	—
PUT	/api/admin/blogs/:id	public	—
DELETE	/api/admin/blogs/:id	public	—
POST	/api/admin/blogs/:id/publish	public	—
POST	/api/admin/blogs/:id/unpublish	public	—

/api/admin/bookings

Method	Path	Auth	Permission
GET	/api/admin/bookings	admin token	—
POST	/api/admin/bookings	admin token	—
PUT	/api/admin/bookings/assign-supplier	admin token	—

/api/admin/contracts

Method	Path	Auth	Permission
GET	/api/admin/contracts	admin token	—
POST	/api/admin/contracts	admin token	—
PUT	/api/admin/contracts/:id	admin token	—
DELETE	/api/admin/contracts/:id	admin token	—

/api/admin/cost-centers

Method	Path	Auth	Permission
GET	/api/admin/cost-centers	admin token	—
POST	/api/admin/cost-centers	admin token	—
PUT	/api/admin/cost-centers/:id	admin token	—
DELETE	/api/admin/cost-centers/:id	admin token	—

/api/admin/discounts

Method	Path	Auth	Permission
GET	/api/admin/discounts/mine	admin token	`bookings`
GET	/api/admin/discounts	admin token · platform only	`discounts`
POST	/api/admin/discounts	admin token · platform only	`discounts`
PUT	/api/admin/discounts/:id	admin token · platform only	`discounts`
DELETE	/api/admin/discounts/:id	admin token · platform only	`discounts`
POST	/api/admin/discounts/:id/allocate	admin token · platform only	`discounts`
DELETE	/api/admin/discounts/:id/allocate/:allocationId	admin token · platform only	`discounts`

/api/admin/employees

Method	Path	Auth	Permission
GET	/api/admin/employees	admin token	—
POST	/api/admin/employees	admin token	—
PUT	/api/admin/employees/:id	admin token	—
DELETE	/api/admin/employees/:id	admin token	—

/api/admin/insurance-policies

Method	Path	Auth	Permission
GET	/api/admin/insurance-policies	admin token	—
POST	/api/admin/insurance-policies	admin token	—

/api/admin/invoices

Method	Path	Auth	Permission
GET	/api/admin/invoices	admin token · platform only	`tenants`
POST	/api/admin/invoices	admin token · platform only	`tenants`
PUT	/api/admin/invoices/:id	admin token · platform only	`tenants`
POST	/api/admin/invoices/:id/payments	admin token · platform only	`tenants`

/api/admin/invoices/mine

Method	Path	Auth	Permission
GET	/api/admin/invoices/mine	admin token	`billing`

/api/admin/leads

Method	Path	Auth	Permission
GET	/api/admin/leads	admin token	—
POST	/api/admin/leads	admin token	—
PUT	/api/admin/leads/:id	admin token	—
DELETE	/api/admin/leads/:id	admin token	—
POST	/api/admin/leads/:id/reply	admin token	—

/api/admin/offers

Method	Path	Auth	Permission
GET	/api/admin/offers/mine	admin token	`bookings`
GET	/api/admin/offers	admin token · platform only	`offers`
POST	/api/admin/offers	admin token · platform only	`offers`
PUT	/api/admin/offers/:id	admin token · platform only	`offers`
DELETE	/api/admin/offers/:id	admin token · platform only	`offers`
POST	/api/admin/offers/:id/allocate	admin token · platform only	`offers`
DELETE	/api/admin/offers/:id/allocate/:allocationId	admin token · platform only	`offers`

/api/admin/payment-gateways

Method	Path	Auth	Permission
GET	/api/admin/payment-gateways	admin token	—
POST	/api/admin/payment-gateways	admin token	—
PUT	/api/admin/payment-gateways/:id	admin token	—
POST	/api/admin/payment-gateways/:id/set-default	admin token	—
DELETE	/api/admin/payment-gateways/:id	admin token	—

/api/admin/policies

Method	Path	Auth	Permission
GET	/api/admin/policies	admin token	—
POST	/api/admin/policies	admin token	—
PUT	/api/admin/policies/:id	admin token	—
DELETE	/api/admin/policies/:id	admin token	—

/api/admin/queries

Method	Path	Auth	Permission
GET	/api/admin/queries/mine	admin token	—
POST	/api/admin/queries	admin token	—
POST	/api/admin/queries/:id/reply	admin token	—

/api/admin/roles

Method	Path	Auth	Permission
GET	/api/admin/roles	admin token	—
POST	/api/admin/roles	admin token	—
PUT	/api/admin/roles/:id	admin token	—
DELETE	/api/admin/roles/:id	admin token	—

/api/admin/sales

Method	Path	Auth	Permission
GET	/api/admin/sales	admin token	—

/api/admin/settings

Method	Path	Auth	Permission
GET	/api/admin/settings	admin token · platform only	`settings`
PUT	/api/admin/settings	admin token · platform only	`settings`
GET	/api/admin/settings/ip-rules	admin token · platform only	`settings`
POST	/api/admin/settings/ip-rules	admin token · platform only	`settings`
DELETE	/api/admin/settings/ip-rules/:id	admin token · platform only	`settings`

/api/admin/suppliers

Method	Path	Auth	Permission
GET	/api/admin/suppliers	admin token	—
POST	/api/admin/suppliers	admin token · platform only	`suppliers`
PUT	/api/admin/suppliers/:id	admin token · platform only	`suppliers`
DELETE	/api/admin/suppliers/:id	admin token · platform only	`suppliers`

/api/admin/tenant

Method	Path	Auth	Permission
GET	/api/admin/tenant/list	admin token	—
GET	/api/admin/tenant	admin token	—
PUT	/api/admin/tenant	admin token	—

/api/admin/tenant-directory

Method	Path	Auth	Permission
GET	/api/admin/tenant-directory	admin token	—
GET	/api/admin/tenant-directory/:id	admin token	—
PUT	/api/admin/tenant-directory/:id	admin token	—
POST	/api/admin/tenant-directory	admin token	—

/api/admin/themes

Method	Path	Auth	Permission
GET	/api/admin/themes	admin token	—
POST	/api/admin/themes	admin token	—

/api/admin/users

Method	Path	Auth	Permission
GET	/api/admin/users	admin token	—
POST	/api/admin/users	admin token	—
PUT	/api/admin/users/:id	admin token	—
DELETE	/api/admin/users/:id	admin token	—

/api/admin/vendors

Method	Path	Auth	Permission
GET	/api/admin/vendors	admin token	—
POST	/api/admin/vendors	admin token	—
PUT	/api/admin/vendors/:id	admin token	—
DELETE	/api/admin/vendors/:id	admin token	—

/api/admin/vouchers

Method	Path	Auth	Permission
POST	/api/admin/vouchers/apply	admin token	`bookings`
GET	/api/admin/vouchers	admin token · platform only	`vouchers`
POST	/api/admin/vouchers	admin token · platform only	`vouchers`
PUT	/api/admin/vouchers/:id	admin token · platform only	`vouchers`
DELETE	/api/admin/vouchers/:id	admin token · platform only	`vouchers`
POST	/api/admin/vouchers/:id/allocate	admin token · platform only	`vouchers`
DELETE	/api/admin/vouchers/:id/allocate/:allocationId	admin token · platform only	`vouchers`

/api/blogs

Method	Path	Auth	Permission
GET	/api/blogs	public	—
GET	/api/blogs/:slug	public	—

/api/bookings

Method	Path	Auth	Permission
GET	/api/bookings	customer token	—
POST	/api/bookings	customer token	—
POST	/api/bookings/:id/cancel	customer token	—

/api/demo-requests

Method	Path	Auth	Permission
POST	/api/demo-requests	public	—

/api/discounts

Method	Path	Auth	Permission
GET	/api/discounts/b2c	public	—

/api/hero-slides

Method	Path	Auth	Permission
GET	/api/hero-slides	public	—
GET	/api/hero-slides/admin	admin token · platform only	`hero-carousel`
POST	/api/hero-slides/admin	admin token · platform only	`hero-carousel`
PUT	/api/hero-slides/admin/:id	admin token · platform only	`hero-carousel`
DELETE	/api/hero-slides/admin/:id	admin token · platform only	`hero-carousel`

/api/newsletter

Method	Path	Auth	Permission
POST	/api/newsletter/subscribe	public	—

/api/offers

Method	Path	Auth	Permission
GET	/api/offers/b2c	public	—

/api/pricing

Method	Path	Auth	Permission
GET	/api/pricing/quote	public	—
GET	/api/pricing/admin/quote	admin token	`bookings`
GET	/api/pricing/rules	admin token · platform only	`pricing`
POST	/api/pricing/rules	admin token · platform only	`pricing`
PUT	/api/pricing/rules/:id	admin token · platform only	`pricing`
DELETE	/api/pricing/rules/:id	admin token · platform only	`pricing`

/api/profile

Method	Path	Auth	Permission
GET	/api/profile	customer token	—
PUT	/api/profile	customer token	—

/api/refunds

Method	Path	Auth	Permission
GET	/api/refunds	customer token	—

/api/search-logs

Method	Path	Auth	Permission
POST	/api/search-logs	public	—

/api/travellers

Method	Path	Auth	Permission
GET	/api/travellers	customer token	—
POST	/api/travellers	customer token	—
DELETE	/api/travellers/:id	customer token	—

/api/vouchers

Method	Path	Auth	Permission
POST	/api/vouchers/apply	public	—

/api/wallet

Method	Path	Auth	Permission
GET	/api/wallet	customer token	—
GET	/api/wallet/promo-codes	customer token	—

/api/webhooks/whatsapp

Method	Path	Auth	Permission
GET	/api/webhooks/whatsapp	public	—
POST	/api/webhooks/whatsapp	public	—