Generated Route Inventory

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Inventory summary

• Generated at: 2026-09-13T07:24:37.102Z
• Route modules scanned: 73
• Mounted route declarations: 82
• Endpoint entries including aliases: 1155
• Generated JSON: memory-bank/generated/partners-api-route-inventory.json
• Generated Markdown: memory-bank/generated/partners-api-route-inventory.md

Endpoint table

Method	Path	Module	Auth scan	Source
GET	/api/admin/attendees	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:475
DELETE	/api/admin/attendees/:attendeeAccountId/incomplete-profile	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:381
DELETE	/api/admin/attendees/disposable-test-identities	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:290
POST	/api/admin/attendees/disposable-test-identities	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:263
GET	/api/admin/user-profiles	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:173
POST	/api/events	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/events/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/events/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/events/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/img/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:63
POST	/api/incidents	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:579
PUT	/api/incidents/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:618
PATCH	/api/incidents/:id/actions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:684
POST	/api/incidents/:id/cross-ban-decision	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:840
POST	/api/internal/test-runs	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1764
DELETE	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3342
POST	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3314
POST	/api/internal/test-runs/:runId/cleanup	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3148
POST	/api/internal/test-runs/:runId/dashboard-session	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1801
POST	/api/internal/test-runs/:runId/rego-sessions/bulk	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1829
DELETE	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3292
POST	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3263
POST	/api/internal/test-runs/:runId/seed/event	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2469
POST	/api/internal/test-runs/:runId/seed/social-graph	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2211
POST	/api/internal/test-runs/:runId/seed/staff	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2039
GET	/api/internal/test-runs/:runId/snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3364
POST	/api/internal/test-runs/:runId/social-withdrawal-snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2386
POST	/api/internal/test-runs/:runId/state/fast-forward	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3065
POST	/api/internal/test-runs/:runId/suppress-side-effects	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3237
POST	/api/internal/test-runs/:runId/verify	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3383
POST	/api/internal/test-runs/:runId/withdraw-auth-identity	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2354
POST	/api/internal/test-runs/sweep	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3196
POST	/api/manage	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/manage/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/manage/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/manage/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/media/:bucket/images/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:64
GET	/api/partner-directory	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1187
POST	/api/pawsports/bind	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:477
GET	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:18
POST	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:77
DELETE	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:152
PUT	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:125
POST	/api/person-profiles/:id/links	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:171
DELETE	/api/person-profiles/:id/links/:reportId	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:204
GET	/api/platform-fees	rows.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rows.ts:1245
GET	/api/rego/event-regos/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:524
GET	/api/rego/event-waitlist/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:654
POST	/api/rego/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:230
PATCH	/api/regos/:id/payment-status	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:713
POST	/api/regos/:regId/email	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:885
POST	/api/regos/:regId/email-preview	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1000
GET	/api/rows	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:116
GET	/api/spa/contracts	spaContracts.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/spaContracts.ts:72
POST	/api/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:229
POST	/api/watchlist/adoptions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:775
POST	/api/watchlist/grants	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:740
POST	/api/watchlist/master-requests	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:809
POST	/api/admin/discord/messages	adminDiscord.ts	Partner dashboard session required.	partners-api/src/routes/adminDiscord.ts:49
GET	/api/admin/discord/targets	adminDiscord.ts	Partner dashboard session required.	partners-api/src/routes/adminDiscord.ts:11
DELETE	/api/admin/events/:eventId/registrations	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:976
GET	/api/admin/members	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:183
POST	/api/admin/members	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:214
DELETE	/api/admin/members/:membershipId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:321
PATCH	/api/admin/members/:membershipId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:383
GET	/api/admin/notices	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:218
POST	/api/admin/notices	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:236
PATCH	/api/admin/notices/:id	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:350
GET	/api/admin/partners	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:63
POST	/api/admin/partners	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:78
PATCH	/api/admin/partners/:partnerId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:121
POST	/api/admin/partners/:partnerId/cms-token	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:465
GET	/api/admin/platform-fee	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:612
PATCH	/api/admin/platform-fee	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:625
GET	/api/admin/platform-security	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:932
PATCH	/api/admin/platform-security	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:942
PUT	/api/admin/settlement-payment-providers	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:798
GET	/api/admin/settlement-settings	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:676
PATCH	/api/admin/settlement-settings	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:714
GET	/api/network-bans/:watchlistEntryId	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:218
PATCH	/api/network-bans/:watchlistEntryId/appeal	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:522
POST	/api/network-bans/:watchlistEntryId/appeal	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:277
GET	/api/network-bans/:watchlistEntryId/appeal-status	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:357
GET	/api/network-bans/:watchlistEntryId/appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:417
GET	/api/network-bans/appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:14
POST	/api/network-bans/appeals/:appealId/decision	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:94
GET	/api/network-bans/my-appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:154
POST	/api/notices/:id/ack	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:192
GET	/api/notices/unacked	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:133
GET	/api/org/settings	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:86
PATCH	/api/org/settings	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:113
POST	/api/org/settings/data-silo/backfill	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:207
GET	/api/access	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:32
GET	/api/cms-token	access.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/access.ts:291
GET	/api/partner-directory	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:268
GET	/api/partner-permissions	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:188
PUT	/api/partner-permissions/members/:userId	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:205
POST	/auth/accept-invite	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:953
POST	/auth/change-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:864
POST	/auth/dev-session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:726
POST	/auth/exchange	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:832
GET	/auth/mfa/status	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:558
POST	/auth/mfa/totp/enroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:614
POST	/auth/mfa/totp/unenroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:688
POST	/auth/mfa/totp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:645
POST	/auth/otp/send	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:376
POST	/auth/otp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:417
POST	/auth/passkey/authentication/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:459
POST	/auth/passkey/authentication/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:478
POST	/auth/passkey/registration/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:507
POST	/auth/passkey/registration/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:528
POST	/auth/recovery-session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1323
POST	/auth/refresh	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:785
POST	/auth/reset-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1289
POST	/auth/set-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1338
POST	/auth/sign-in	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:348
POST	/auth/sign-out	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:900
POST	/auth/sign-up	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1028
PUT	/auth/social/profile	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1209
GET	/auth/social/session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1149
POST	/auth/social/sessions/revoke-others	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:931
POST	/auth/social/sign-up	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:1059
POST	/hooks/send-email	authEmail.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/authEmail.ts:868
GET	/api/lan-system/releases/assets/:assetId	lanSystemReleases.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSystemReleases.ts:154
GET	/api/lan-system/releases/latest	lanSystemReleases.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSystemReleases.ts:99
GET	/api/events/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:622
PUT	/api/events/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:635
POST	/api/events/:id/activities/submissions/:submissionId/review	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:709
PUT	/api/events/:id/addons	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:605
PUT	/api/events/:id/check-in/:kind/:recordId	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2533
PUT	/api/events/:id/check-in/:kind/:recordId/claim	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2616
GET	/api/events/:id/check-in/entries	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2227
GET	/api/events/:id/check-in/entry	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2239
GET	/api/events/:id/check-in/offline-snapshot	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2375
GET	/api/events/:id/check-in/offline-snapshot/history	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2362
POST	/api/events/:id/check-in/offline-snapshot/import	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2496
POST	/api/events/:id/check-in/pawsport-lookup	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2262
GET	/api/events/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2189
PUT	/api/events/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2202
GET	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
GET	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
PUT	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
PUT	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
GET	/api/events/:id/dealers-den/applications	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1218
DELETE	/api/events/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1200
GET	/api/events/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1249
POST	/api/events/:id/dealers-den/applications/:appId/approve	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1278
POST	/api/events/:id/dealers-den/applications/:appId/deny	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1371
POST	/api/events/:id/dealers-den/applications/:appId/request-changes	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1464
GET	/api/events/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:809
POST	/api/events/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:825
DELETE	/api/events/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:888
PUT	/api/events/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:867
PUT	/api/events/:id/dealers-den/packages/order	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:844
GET	/api/events/:id/dealers-den/regos	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:904
DELETE	/api/events/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:975
PATCH	/api/events/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1021
GET	/api/events/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:709
PUT	/api/events/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:752
GET	/api/events/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:229
PUT	/api/events/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:290
GET	/api/events/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1344
PUT	/api/events/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1375
POST	/api/events/:id/human-resources/applications/:applicationId/review	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1676
GET	/api/events/:id/human-resources/live-tracker	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1635
GET	/api/events/:id/human-resources/users/search	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1359
PUT	/api/events/:id/inclusions	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:379
GET	/api/events/:id/inventory	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1366
GET	/api/events/:id/inventory/movements	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1497
PUT	/api/events/:id/inventory/on-hand	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1413
POST	/api/events/:id/inventory/pos/quote	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1561
GET	/api/events/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1541
POST	/api/events/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1616
PUT	/api/events/:id/inventory/settings	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1380
POST	/api/events/:id/notifications/sample	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:54
GET	/api/events/:id/prefills	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:77
POST	/api/events/:id/prefills/:prefillId/revoke	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:115
PUT	/api/events/:id/public-visibility	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:142
GET	/api/events/:id/rego/analytics	regoAnalytics.ts	Partner dashboard session required.	partners-api/src/routes/regoAnalytics.ts:159
PUT	/api/events/:id/tiers	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:460
GET	/api/manage/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:622
PUT	/api/manage/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:635
POST	/api/manage/:id/activities/submissions/:submissionId/review	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:709
PUT	/api/manage/:id/addons	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:605
PUT	/api/manage/:id/check-in/:kind/:recordId	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2533
PUT	/api/manage/:id/check-in/:kind/:recordId/claim	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2616
GET	/api/manage/:id/check-in/entries	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2227
GET	/api/manage/:id/check-in/entry	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2239
GET	/api/manage/:id/check-in/offline-snapshot	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2375
GET	/api/manage/:id/check-in/offline-snapshot/history	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2362
POST	/api/manage/:id/check-in/offline-snapshot/import	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2496
POST	/api/manage/:id/check-in/pawsport-lookup	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2262
GET	/api/manage/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2189
PUT	/api/manage/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2202
GET	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
GET	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
PUT	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
PUT	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
GET	/api/manage/:id/dealers-den/applications	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1218
DELETE	/api/manage/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1200
GET	/api/manage/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1249
POST	/api/manage/:id/dealers-den/applications/:appId/approve	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1278
POST	/api/manage/:id/dealers-den/applications/:appId/deny	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1371
POST	/api/manage/:id/dealers-den/applications/:appId/request-changes	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1464
GET	/api/manage/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:809
POST	/api/manage/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:825
DELETE	/api/manage/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:888
PUT	/api/manage/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:867
PUT	/api/manage/:id/dealers-den/packages/order	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:844
GET	/api/manage/:id/dealers-den/regos	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:904
DELETE	/api/manage/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:975
PATCH	/api/manage/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1021
GET	/api/manage/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:709
PUT	/api/manage/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:752
GET	/api/manage/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:229
PUT	/api/manage/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:290
GET	/api/manage/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1344
PUT	/api/manage/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1375
POST	/api/manage/:id/human-resources/applications/:applicationId/review	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1676
GET	/api/manage/:id/human-resources/live-tracker	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1635
GET	/api/manage/:id/human-resources/users/search	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1359
PUT	/api/manage/:id/inclusions	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:379
GET	/api/manage/:id/inventory	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1366
GET	/api/manage/:id/inventory/movements	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1497
PUT	/api/manage/:id/inventory/on-hand	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1413
POST	/api/manage/:id/inventory/pos/quote	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1561
GET	/api/manage/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1541
POST	/api/manage/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1616
PUT	/api/manage/:id/inventory/settings	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1380
POST	/api/manage/:id/notifications/sample	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:54
GET	/api/manage/:id/prefills	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:77
POST	/api/manage/:id/prefills/:prefillId/revoke	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:115
PUT	/api/manage/:id/public-visibility	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:142
GET	/api/manage/:id/rego/analytics	regoAnalytics.ts	Partner dashboard session required.	partners-api/src/routes/regoAnalytics.ts:159
PUT	/api/manage/:id/tiers	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:460
GET	/api/rego/activities/submissions/my	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:941
GET	/api/rego/dealers-den/:eventId/info	dealersDen.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/dealersDen.ts:1562
POST	/api/rego/dealers-den/applications	dealersDen.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/dealersDen.ts:1805
DELETE	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2017
GET	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1755
PATCH	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1939
POST	/api/rego/dealers-den/applications/:appId/assistants	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2055
DELETE	/api/rego/dealers-den/applications/:appId/assistants/:aid	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2136
GET	/api/rego/dealers-den/applications/my	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1667
PATCH	/api/rego/dealers-den/assistants/:aid/respond	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2173
POST	/api/rego/dealers-den/events/:eventId/reserve	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2217
GET	/api/rego/dealers-den/regos/:regoId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2763
GET	/api/rego/dealers-den/regos/:regoId/wallet	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2893
GET	/api/rego/dealers-den/regos/my	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1687
POST	/api/rego/dealers-den/regos/submit	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2351
POST	/api/rego/dealers-den/reservations/:id/release	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2317
GET	/api/rego/events/:slug/activities	activities.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/activities.ts:800
GET	/api/rego/events/:slug/activities/:activitySlug	activities.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/activities.ts:1044
POST	/api/rego/events/:slug/activities/:activitySlug/submissions	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:1099
GET	/api/rego/events/:slug/activities/submissions/my	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:853
GET	/api/rego/events/:slug/shift-authorizers	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:2181
POST	/api/rego/events/:slug/volunteer-applications	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:1860
GET	/api/rego/events/:slug/volunteer-opportunities	humanResources.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/humanResources.ts:1764
GET	/api/rego/human-resources/me	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:1998
POST	/api/rego/human-resources/shifts/:shiftId/track	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:2225
POST	/api/rego/notices/:id/ack	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:145
GET	/api/rego/notices/unacked	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:60
GET	/api/rego/notifications	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:192
POST	/api/rego/notifications/:id/read	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:279
POST	/api/rego/notifications/mark-all-read	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:307
GET	/api/rego/notifications/unread-count	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:255
GET	/api/rego/transactions/me	inventory.ts	Rego attendee session required.	partners-api/src/routes/inventory.ts:1724
POST	/api/events/:eventId/payment-accounts/:accountId/report	paymentAccountReports.ts	Rego attendee session required.	partners-api/src/routes/paymentAccountReports.ts:18
GET	/api/events/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:536
PUT	/api/events/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:551
GET	/api/events/:id/finance/accounting	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1022
POST	/api/events/:id/finance/accounting/deductions	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1190
POST	/api/events/:id/finance/accounting/entries	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1177
PATCH	/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1203
GET	/api/events/:id/finance/analytics	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:998
GET	/api/events/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1293
POST	/api/events/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1356
POST	/api/events/:id/finance/settlements/quote	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1319
GET	/api/events/:id/payment-account-reports	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:202
GET	/api/events/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:93
PUT	/api/events/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:117
GET	/api/events/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:125
PUT	/api/events/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:182
GET	/api/events/:id/rego-refunds	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:959
PATCH	/api/events/:id/rego-refunds/:refundId/review	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:981
GET	/api/events/:id/rego-transfers	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:928
PATCH	/api/events/:id/rego-transfers/:transferId/review	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:950
GET	/api/events/:id/rego-upgrades	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1330
PATCH	/api/events/:id/rego-upgrades/:upgradeId/review	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1394
POST	/api/manage/:eventId/payment-accounts/:accountId/report	paymentAccountReports.ts	Rego attendee session required.	partners-api/src/routes/paymentAccountReports.ts:18
GET	/api/manage/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:536
PUT	/api/manage/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:551
GET	/api/manage/:id/finance/accounting	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1022
POST	/api/manage/:id/finance/accounting/deductions	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1190
POST	/api/manage/:id/finance/accounting/entries	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1177
PATCH	/api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1203
GET	/api/manage/:id/finance/analytics	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:998
GET	/api/manage/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1293
POST	/api/manage/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1356
POST	/api/manage/:id/finance/settlements/quote	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1319
GET	/api/manage/:id/payment-account-reports	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:202
GET	/api/manage/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:93
PUT	/api/manage/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:117
GET	/api/manage/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:125
PUT	/api/manage/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:182
GET	/api/manage/:id/rego-refunds	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:959
PATCH	/api/manage/:id/rego-refunds/:refundId/review	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:981
GET	/api/manage/:id/rego-transfers	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:928
PATCH	/api/manage/:id/rego-transfers/:transferId/review	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:950
GET	/api/manage/:id/rego-upgrades	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1330
PATCH	/api/manage/:id/rego-upgrades/:upgradeId/review	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1394
POST	/api/rego/rego-upgrades/:id/pay	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:1197
GET	/api/rego/regos/:ref/refunds	regoRefunds.ts	Rego attendee session required.	partners-api/src/routes/regoRefunds.ts:744
POST	/api/rego/regos/:ref/refunds	regoRefunds.ts	Rego attendee session required.	partners-api/src/routes/regoRefunds.ts:799
GET	/api/rego/regos/:ref/transfers	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:630
POST	/api/rego/regos/:ref/transfers	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:692
GET	/api/rego/regos/:ref/upgrades	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:943
POST	/api/rego/regos/:ref/upgrades	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:1032
GET	/api/rego/users/transfer-search	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:599
GET	/api/admin/platform-waitlist	platformWaitlist.ts	Partner dashboard session required.	partners-api/src/routes/platformWaitlist.ts:205
GET	/api/admin/platform-waitlist	platformWaitlist.ts	Partner dashboard session required.	partners-api/src/routes/platformWaitlist.ts:205
GET	/api/admin/social-advertising/campaigns	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:91
POST	/api/admin/social-advertising/campaigns	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:105
GET	/api/admin/social-advertising/campaigns/:campaignId/daily-metrics	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:170
GET	/api/admin/social-advertising/campaigns/:campaignId/history	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:157
POST	/api/admin/social-advertising/campaigns/:campaignId/transition	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:127
GET	/api/admin/social-advertising/providers	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:147
POST	/api/admin/social-advertising/providers/adsense	socialAdvertisingAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialAdvertisingAdmin.ts:189
GET	/api/admin/social-location/eligibility	socialLocationAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialLocationAdmin.ts:35
POST	/api/admin/social-location/eligibility	socialLocationAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialLocationAdmin.ts:48
DELETE	/api/admin/social-location/eligibility/:accountId	socialLocationAdmin.ts	Partner dashboard session required.	partners-api/src/routes/socialLocationAdmin.ts:68
POST	/api/assets	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:863
GET	/api/assets/agreements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:804
POST	/api/assets/agreements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:819
GET	/api/assets/alerts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2085
GET	/api/assets/audits	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:576
POST	/api/assets/audits/:id/count-sheet/validate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2051
GET	/api/assets/audits/:id/results	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:594
GET	/api/assets/capabilities	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2397
PUT	/api/assets/capabilities/:key	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2411
GET	/api/assets/catalog	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:712
POST	/api/assets/catalog/categories	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:737
POST	/api/assets/catalog/models	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:754
GET	/api/assets/checkouts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:999
POST	/api/assets/checkouts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:982
POST	/api/assets/checkouts/:id/acknowledge	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1033
GET	/api/assets/checkouts/:id/eligibility	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1045
POST	/api/assets/checkouts/:id/return	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1071
POST	/api/assets/containers/:id/pack	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1150
DELETE	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1912
GET	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1893
PUT	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1902
GET	/api/assets/eligible-users	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:517
GET	/api/assets/evidence	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2280
POST	/api/assets/evidence	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2198
GET	/api/assets/evidence/:id/content	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2302
POST	/api/assets/evidence/:id/review	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2350
GET	/api/assets/finance/adapters/:format	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2383
GET	/api/assets/finance/context	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1219
GET	/api/assets/finance/rollforward	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1199
POST	/api/assets/finance/value-entries	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1231
GET	/api/assets/hub/overview	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1314
GET	/api/assets/hub/records	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1430
GET	/api/assets/hub/summary	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1331
GET	/api/assets/hub/tasks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1377
POST	/api/assets/hub/tasks/assign	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1694
POST	/api/assets/identifiers/issue	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:906
GET	/api/assets/imports/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2070
POST	/api/assets/imports/csv/validate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2030
GET	/api/assets/interoperability/epcis	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2010
GET	/api/assets/interoperability/snapshot	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2000
GET	/api/assets/items/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:552
POST	/api/assets/items/:id/activate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:891
GET	/api/assets/loaned	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:475
GET	/api/assets/locations	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:677
POST	/api/assets/locations	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:691
GET	/api/assets/movements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:839
GET	/api/assets/openapi.json	assets.ts	Partner dashboard session required.	partners-api/src/routes/assets.ts:375
GET	/api/assets/owned	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:474
GET	/api/assets/parties	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:771
POST	/api/assets/parties	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:785
GET	/api/assets/policies	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1979
POST	/api/assets/policies	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1921
GET	/api/assets/policies/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1971
POST	/api/assets/policies/:id/decision	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1961
POST	/api/assets/policies/:id/submit	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1951
GET	/api/assets/saved-views	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:477
POST	/api/assets/saved-views	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:491
DELETE	/api/assets/saved-views/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:505
POST	/api/assets/scan/resolve	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:931
GET	/api/assets/search	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:659
GET	/api/assets/settings/records	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1452
GET	/api/assets/shipments	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1109
POST	/api/assets/shipments	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1092
POST	/api/assets/shipments/:id/containers	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1131
POST	/api/assets/shipments/:id/dispatch	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1170
POST	/api/assets/shipments/:id/receive	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1184
GET	/api/assets/summary	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:380
GET	/api/assets/transit-exceptions	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:625
GET	/api/assets/webhooks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2122
POST	/api/assets/webhooks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2099
PUT	/api/assets/webhooks/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2133
GET	/api/assets/webhooks/:id/deliveries	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2186
POST	/api/assets/webhooks/:id/test	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2166
GET	/api/assets/work-orders	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:609
GET	/api/assets/work-orders/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:632
GET	/api/assets/workflow-cases	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1754
POST	/api/assets/workflow-cases	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1861
GET	/api/assets/workflow-cases/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1796
POST	/api/assets/workflow-cases/:id/decision	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1826
GET	/api/attendee-accounts/lookup	attendeeAccounts.ts	Partner dashboard session required.	partners-api/src/routes/attendeeAccounts.ts:39
GET	/api/attendee-accounts/search	attendeeAccounts.ts	Partner dashboard session required.	partners-api/src/routes/attendeeAccounts.ts:25
GET	/api/events/:eventId/feedback-form	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:129
PUT	/api/events/:eventId/feedback-form/draft	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:143
POST	/api/events/:eventId/feedback-form/publish	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:203
POST	/api/events/:eventId/feedback-form/standard-template	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:177
GET	/api/events/:eventId/feedback-submissions	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:541
GET	/api/events/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:460
PATCH	/api/events/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:486
POST	/api/events/:eventId/feedback-submissions/:submissionId/notes	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:511
GET	/api/events/:eventId/feedback-submissions/export.csv	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:407
GET	/api/events/:eventId/forecasts	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:47
PATCH	/api/events/:eventId/forecasts/control	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:78
GET	/api/events/:eventId/lan-sync/changes	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:503
POST	/api/events/:eventId/lan-sync/evidence	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:404
GET	/api/events/:eventId/lan-sync/health	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:334
POST	/api/events/:eventId/lan-sync/operations	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:349
GET	/api/events/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:266
POST	/api/events/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:280
POST	/api/events/:eventId/lan-sync/sessions/:sessionId/revoke	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:317
GET	/api/events/:id/shop/cart	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1573
POST	/api/events/:id/shop/cart/items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1584
DELETE	/api/events/:id/shop/cart/items/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1624
POST	/api/events/:id/shop/cart/validate	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1643
POST	/api/events/:id/shop/categories	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1483
DELETE	/api/events/:id/shop/categories/:categoryId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1515
PUT	/api/events/:id/shop/categories/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1502
POST	/api/events/:id/shop/checkout	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1654
POST	/api/events/:id/shop/claim/lookup	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2468
GET	/api/events/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1342
POST	/api/events/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1353
POST	/api/events/:id/shop/couriers	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1537
POST	/api/events/:id/shop/couriers/:courierId/rates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1556
GET	/api/events/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1366
POST	/api/events/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1427
DELETE	/api/events/:id/shop/listings/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1460
PUT	/api/events/:id/shop/listings/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1447
GET	/api/events/:id/shop/my-orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1845
GET	/api/events/:id/shop/my-orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1860
POST	/api/events/:id/shop/my-orders/:orderId/payment	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1905
GET	/api/events/:id/shop/orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1972
GET	/api/events/:id/shop/orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2106
POST	/api/events/:id/shop/orders/:orderId/claim	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2300
POST	/api/events/:id/shop/orders/:orderId/claim-exception	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2375
POST	/api/events/:id/shop/orders/:orderId/payment-review	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2191
POST	/api/events/:id/shop/orders/:orderId/status	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2134
POST	/api/events/:id/shop/orders/:orderId/updates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2254
GET	/api/events/:id/shop/orders/dashboard	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1995
GET	/api/events/:id/shop/public	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1330
GET	/api/events/:id/shop/source-items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1378
GET	/api/geo/countries	geo.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/geo.ts:55
GET	/api/geo/states/:iso2	geo.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/geo.ts:69
GET	/api/manage/:eventId/feedback-form	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:129
PUT	/api/manage/:eventId/feedback-form/draft	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:143
POST	/api/manage/:eventId/feedback-form/publish	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:203
POST	/api/manage/:eventId/feedback-form/standard-template	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:177
GET	/api/manage/:eventId/feedback-submissions	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:541
GET	/api/manage/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:460
PATCH	/api/manage/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:486
POST	/api/manage/:eventId/feedback-submissions/:submissionId/notes	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:511
GET	/api/manage/:eventId/feedback-submissions/export.csv	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:407
GET	/api/manage/:eventId/forecasts	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:47
PATCH	/api/manage/:eventId/forecasts/control	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:78
GET	/api/manage/:eventId/lan-sync/changes	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:503
POST	/api/manage/:eventId/lan-sync/evidence	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:404
GET	/api/manage/:eventId/lan-sync/health	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:334
POST	/api/manage/:eventId/lan-sync/operations	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:349
GET	/api/manage/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:266
POST	/api/manage/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:280
POST	/api/manage/:eventId/lan-sync/sessions/:sessionId/revoke	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:317
GET	/api/manage/:id/shop/cart	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1573
POST	/api/manage/:id/shop/cart/items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1584
DELETE	/api/manage/:id/shop/cart/items/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1624
POST	/api/manage/:id/shop/cart/validate	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1643
POST	/api/manage/:id/shop/categories	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1483
DELETE	/api/manage/:id/shop/categories/:categoryId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1515
PUT	/api/manage/:id/shop/categories/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1502
POST	/api/manage/:id/shop/checkout	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1654
POST	/api/manage/:id/shop/claim/lookup	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2468
GET	/api/manage/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1342
POST	/api/manage/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1353
POST	/api/manage/:id/shop/couriers	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1537
POST	/api/manage/:id/shop/couriers/:courierId/rates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1556
GET	/api/manage/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1366
POST	/api/manage/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1427
DELETE	/api/manage/:id/shop/listings/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1460
PUT	/api/manage/:id/shop/listings/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1447
GET	/api/manage/:id/shop/my-orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1845
GET	/api/manage/:id/shop/my-orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1860
POST	/api/manage/:id/shop/my-orders/:orderId/payment	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1905
GET	/api/manage/:id/shop/orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1972
GET	/api/manage/:id/shop/orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2106
POST	/api/manage/:id/shop/orders/:orderId/claim	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2300
POST	/api/manage/:id/shop/orders/:orderId/claim-exception	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2375
POST	/api/manage/:id/shop/orders/:orderId/payment-review	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2191
POST	/api/manage/:id/shop/orders/:orderId/status	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2134
POST	/api/manage/:id/shop/orders/:orderId/updates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2254
GET	/api/manage/:id/shop/orders/dashboard	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1995
GET	/api/manage/:id/shop/public	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1330
GET	/api/manage/:id/shop/source-items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1378
GET	/api/partners/:partnerId/finance/access	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:328
GET	/api/partners/:partnerId/finance/accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:350
GET	/api/partners/:partnerId/finance/audit	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1799
PUT	/api/partners/:partnerId/finance/cash-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:374
GET	/api/partners/:partnerId/finance/continuity-runs	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1465
POST	/api/partners/:partnerId/finance/continuity-runs	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1474
GET	/api/partners/:partnerId/finance/controls	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1456
GET	/api/partners/:partnerId/finance/counterparties	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1056
POST	/api/partners/:partnerId/finance/counterparties	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1073
GET	/api/partners/:partnerId/finance/custody-sessions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1281
POST	/api/partners/:partnerId/finance/custody-sessions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1290
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1357
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1377
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1335
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1311
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1399
GET	/api/partners/:partnerId/finance/default-payment-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:431
PUT	/api/partners/:partnerId/finance/default-payment-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:461
GET	/api/partners/:partnerId/finance/disbursements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:729
POST	/api/partners/:partnerId/finance/disbursements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1591
POST	/api/partners/:partnerId/finance/disbursements/:requestId/actions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1632
GET	/api/partners/:partnerId/finance/disbursements/:requestId/evidence/download	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:766
POST	/api/partners/:partnerId/finance/entries	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:590
POST	/api/partners/:partnerId/finance/entries/:entryId/allocations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:645
POST	/api/partners/:partnerId/finance/entries/:entryId/reverse	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:626
GET	/api/partners/:partnerId/finance/events	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:672
POST	/api/partners/:partnerId/finance/evidence	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1136
POST	/api/partners/:partnerId/finance/evidence/:evidenceId/access	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1188
GET	/api/partners/:partnerId/finance/export.csv	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1825
GET	/api/partners/:partnerId/finance/history	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:502
GET	/api/partners/:partnerId/finance/history/:entryId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:557
GET	/api/partners/:partnerId/finance/imports	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:824
GET	/api/partners/:partnerId/finance/imports/:batchId/rows	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:834
GET	/api/partners/:partnerId/finance/integrations/health	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1418
POST	/api/partners/:partnerId/finance/integrations/profiles	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1435
GET	/api/partners/:partnerId/finance/interchange/export	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:936
GET	/api/partners/:partnerId/finance/interchange/profiles	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:916
POST	/api/partners/:partnerId/finance/interchange/ubl-invoice-preview	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:922
GET	/api/partners/:partnerId/finance/notifications/destinations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1720
PUT	/api/partners/:partnerId/finance/notifications/destinations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1734
GET	/api/partners/:partnerId/finance/notifications/discord-channels	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1703
GET	/api/partners/:partnerId/finance/notifications/options	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1680
GET	/api/partners/:partnerId/finance/periods	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1014
POST	/api/partners/:partnerId/finance/periods/:periodId/close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1023
POST	/api/partners/:partnerId/finance/periods/:periodId/reopen	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1040
GET	/api/partners/:partnerId/finance/reconciliation-status	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:997
GET	/api/partners/:partnerId/finance/reconciliations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:963
POST	/api/partners/:partnerId/finance/reconciliations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:972
POST	/api/partners/:partnerId/finance/reconciliations/import-preview	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:876
GET	/api/partners/:partnerId/finance/records	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1094
POST	/api/partners/:partnerId/finance/records	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1210
GET	/api/partners/:partnerId/finance/records/:recordId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1109
POST	/api/partners/:partnerId/finance/records/:recordId/actions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1247
GET	/api/partners/:partnerId/finance/summary	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:334
POST	/api/partners/:partnerId/finance/work-locks	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1526
DELETE	/api/partners/:partnerId/finance/work-locks/:lockId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1576
POST	/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1561
GET	/api/partners/:partnerId/operations-linkage/access	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1400
GET	/api/partners/:partnerId/operations-linkage/coverage	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1450
GET	/api/partners/:partnerId/operations-linkage/deployments	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2313
POST	/api/partners/:partnerId/operations-linkage/deployments	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2352
GET	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2498
POST	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2664
GET	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2574
GET	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/substitutions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2641
GET	/api/partners/:partnerId/operations-linkage/dimensions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1888
POST	/api/partners/:partnerId/operations-linkage/dimensions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2032
GET	/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1951
POST	/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2111
POST	/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2164
POST	/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links/:systemLinkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2220
GET	/api/partners/:partnerId/operations-linkage/exceptions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3818
POST	/api/partners/:partnerId/operations-linkage/exceptions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3956
GET	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3837
POST	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:4025
GET	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fix-preview	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3878
POST	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fixes	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3903
GET	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/retry-preview	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3853
GET	/api/partners/:partnerId/operations-linkage/exports	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:4130
GET	/api/partners/:partnerId/operations-linkage/finance/asset-batches	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3663
POST	/api/partners/:partnerId/operations-linkage/finance/asset-batches	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3736
POST	/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3792
GET	/api/partners/:partnerId/operations-linkage/finance/asset-mappings	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3580
POST	/api/partners/:partnerId/operations-linkage/finance/asset-mappings	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3598
POST	/api/partners/:partnerId/operations-linkage/finance/asset-mappings/:mappingId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3636
GET	/api/partners/:partnerId/operations-linkage/finance/coding-proposals	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2834
POST	/api/partners/:partnerId/operations-linkage/finance/coding-proposals	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2847
POST	/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2906
GET	/api/partners/:partnerId/operations-linkage/finance/cost-handoffs	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3447
POST	/api/partners/:partnerId/operations-linkage/finance/cost-handoffs	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3484
POST	/api/partners/:partnerId/operations-linkage/finance/cost-handoffs/:handoffId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3545
GET	/api/partners/:partnerId/operations-linkage/finance/dimension-policies	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2222
POST	/api/partners/:partnerId/operations-linkage/finance/dimension-policies	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2246
POST	/api/partners/:partnerId/operations-linkage/finance/dimension-policies/:policyId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2283
POST	/api/partners/:partnerId/operations-linkage/finance/ems-annotations/:annotationId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2954
GET	/api/partners/:partnerId/operations-linkage/finance/ems-reconciliation	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3009
GET	/api/partners/:partnerId/operations-linkage/finance/ems-sources	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3022
GET	/api/partners/:partnerId/operations-linkage/finance/postings	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3676
GET	/api/partners/:partnerId/operations-linkage/intakes	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3316
POST	/api/partners/:partnerId/operations-linkage/intakes	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3358
POST	/api/partners/:partnerId/operations-linkage/intakes/:intakeId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3399
GET	/api/partners/:partnerId/operations-linkage/links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1577
POST	/api/partners/:partnerId/operations-linkage/links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1668
GET	/api/partners/:partnerId/operations-linkage/links/:linkId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1637
PATCH	/api/partners/:partnerId/operations-linkage/links/:linkId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1852
POST	/api/partners/:partnerId/operations-linkage/links/:linkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1851
GET	/api/partners/:partnerId/operations-linkage/links/candidates	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1599
GET	/api/partners/:partnerId/operations-linkage/metrics	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1406
GET	/api/partners/:partnerId/operations-linkage/parties	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1886
POST	/api/partners/:partnerId/operations-linkage/parties	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1953
GET	/api/partners/:partnerId/operations-linkage/parties/:partyId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1949
POST	/api/partners/:partnerId/operations-linkage/parties/:partyId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2109
POST	/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2162
POST	/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2218
GET	/api/partners/:partnerId/operations-linkage/places	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1887
POST	/api/partners/:partnerId/operations-linkage/places	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1989
GET	/api/partners/:partnerId/operations-linkage/places/:placeId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1950
POST	/api/partners/:partnerId/operations-linkage/places/:placeId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2110
POST	/api/partners/:partnerId/operations-linkage/places/:placeId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2163
POST	/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:2219
GET	/api/partners/:partnerId/operations-linkage/procurement	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3096
POST	/api/partners/:partnerId/operations-linkage/procurement	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3224
POST	/api/partners/:partnerId/operations-linkage/procurement/:procurementId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:3284
GET	/api/partners/:partnerId/operations-linkage/receipts	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:4100
GET	/api/partners/:partnerId/operations-linkage/search	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:4195
GET	/api/partners/:partnerId/operations-linkage/timeline	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:4294
GET	/api/pawsports	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:392
DELETE	/api/pawsports/:id	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:878
PATCH	/api/pawsports/:id	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:808
POST	/api/pawsports/:id/notes	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:894
DELETE	/api/pawsports/:id/notes/:noteId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:963
PATCH	/api/pawsports/:id/notes/:noteId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:929
POST	/api/pawsports/:id/reassign	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:1054
POST	/api/pawsports/:id/reissue	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:633
POST	/api/pawsports/:id/restore	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:981
POST	/api/pawsports/:id/revoke	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:600
POST	/api/pawsports/:id/stamps	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:752
DELETE	/api/pawsports/:id/stamps/:stampId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:790
POST	/api/pawsports/:id/unbind	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:1022
GET	/api/pawsports/attendees/lookup	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:357
POST	/api/pawsports/bind	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:596
POST	/api/pawsports/issue	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:481
GET	/api/planning/artifacts/:artifactId/content	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2543
GET	/api/planning/meta	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:945
GET	/api/planning/my-work	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1058
GET	/api/planning/openapi.json	planning.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planning.ts:109
GET	/api/planning/projects	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:954
POST	/api/planning/projects	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:986
GET	/api/planning/projects/:projectId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1425
PATCH	/api/planning/projects/:projectId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1694
POST	/api/planning/projects/:projectId/:collection	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3229
DELETE	/api/planning/projects/:projectId/:collection/:resourceId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3343
PATCH	/api/planning/projects/:projectId/:collection/:resourceId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3276
POST	/api/planning/projects/:projectId/agenda-templates	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3027
POST	/api/planning/projects/:projectId/artifacts	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2476
PATCH	/api/planning/projects/:projectId/artifacts/:artifactId/controls	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2597
POST	/api/planning/projects/:projectId/artifacts/:artifactId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2579
POST	/api/planning/projects/:projectId/artifacts/:artifactId/versions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2524
GET	/api/planning/projects/:projectId/audit	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3115
POST	/api/planning/projects/:projectId/baselines	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1996
GET	/api/planning/projects/:projectId/bootstrap	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1217
GET	/api/planning/projects/:projectId/calendar.ics	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1588
GET	/api/planning/projects/:projectId/calendar.jscalendar	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1653
POST	/api/planning/projects/:projectId/canonical-command	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2392
GET	/api/planning/projects/:projectId/change-sets	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2278
POST	/api/planning/projects/:projectId/change-sets	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2294
POST	/api/planning/projects/:projectId/change-sets/:changeSetId/apply	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2385
POST	/api/planning/projects/:projectId/change-sets/:changeSetId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2348
POST	/api/planning/projects/:projectId/comments	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3126
PUT	/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3151
GET	/api/planning/projects/:projectId/decision-participants	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2807
GET	/api/planning/projects/:projectId/delivery-history	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:786
DELETE	/api/planning/projects/:projectId/departments/:departmentId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2945
POST	/api/planning/projects/:projectId/departments/:departmentId/memberships	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2864
DELETE	/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2925
PATCH	/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2893
POST	/api/planning/projects/:projectId/dependencies	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1849
DELETE	/api/planning/projects/:projectId/dependencies/:dependencyId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2028
POST	/api/planning/projects/:projectId/destinations	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2420
POST	/api/planning/projects/:projectId/destinations/:destinationId/rotate	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3004
POST	/api/planning/projects/:projectId/destinations/:destinationId/test	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2459
GET	/api/planning/projects/:projectId/event-catalog	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1739
POST	/api/planning/projects/:projectId/exercises	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3047
POST	/api/planning/projects/:projectId/gates/:gateId/decisions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3075
POST	/api/planning/projects/:projectId/handoffs	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3093
GET	/api/planning/projects/:projectId/handoffs/:handoffId/export	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3109
POST	/api/planning/projects/:projectId/imports	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3203
POST	/api/planning/projects/:projectId/link-event	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1719
GET	/api/planning/projects/:projectId/meetings/:meetingId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1674
POST	/api/planning/projects/:projectId/meetings/:meetingId/agenda	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2139
POST	/api/planning/projects/:projectId/meetings/:meetingId/agenda/state	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2166
POST	/api/planning/projects/:projectId/meetings/:meetingId/minutes	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2172
POST	/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2199
POST	/api/planning/projects/:projectId/meetings/:meetingId/notes	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3167
PUT	/api/planning/projects/:projectId/meetings/:meetingId/rsvp	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3158
GET	/api/planning/projects/:projectId/member-directory	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2768
GET	/api/planning/projects/:projectId/my-reminder-channels	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:296
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:454
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:457
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:477
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:455
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:755
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/resend	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:661
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:656
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:744
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:765
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:679
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:330
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:384
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:404
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:375
POST	/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:815
POST	/api/planning/projects/:projectId/notification-outbox/:outboxId/retry	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:800
PUT	/api/planning/projects/:projectId/notification-preferences	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3178
POST	/api/planning/projects/:projectId/notification-rules	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2014
GET	/api/planning/projects/:projectId/pages/:collection	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1258
POST	/api/planning/projects/:projectId/requirement-packs/instantiate	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2972
POST	/api/planning/projects/:projectId/requirement-templates	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2962
PUT	/api/planning/projects/:projectId/requirements/:requirementId/approval-flow	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2688
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2082
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2631
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2131
GET	/api/planning/projects/:projectId/requirements/:requirementId/work-items	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2042
POST	/api/planning/projects/:projectId/requirements/:requirementId/work-items	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2058
POST	/api/planning/projects/:projectId/resource-links	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1798
DELETE	/api/planning/projects/:projectId/resource-links/:linkId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1834
POST	/api/planning/projects/:projectId/risks/:riskId/lifecycle	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2731
POST	/api/planning/projects/:projectId/saved-views	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3192
DELETE	/api/planning/projects/:projectId/saved-views/:viewId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3198
GET	/api/planning/projects/:projectId/schedule-window	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1346
POST	/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:825
GET	/api/planning/projects/:projectId/usernames/search	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2831
PUT	/api/planning/projects/:projectId/watchers	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3142
POST	/api/planning/projects/:projectId/work-items/:workItemId/reschedule	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1895
POST	/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1935
POST	/api/planning/projects/:projectId/work-items/:workItemId/wbs-position	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1960
GET	/api/planning/projects/:projectId/workload-window	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1381
POST	/api/planning/sms-gateway/devices/:deviceId/heartbeat	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:922
POST	/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:1087
POST	/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:1037
POST	/api/planning/sms-gateway/devices/:deviceId/lease	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:946
GET	/api/planning/sms-gateway/devices/:deviceId/preflight	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:906
POST	/api/platform/waitlist	platformWaitlist.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/platformWaitlist.ts:108
POST	/api/platform/waitlist	platformWaitlist.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/platformWaitlist.ts:108
GET	/api/rego/events/:slug/feedback	eventFeedback.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventFeedback.ts:240
POST	/api/rego/events/:slug/feedback/submissions	eventFeedback.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventFeedback.ts:277
GET	/api/rego/pawsport	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1280
POST	/api/rego/pawsport/:id/lost	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1230
POST	/api/rego/pawsport/enroll	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1134
DELETE	/api/rego/social/identity-link	socialIdentityLink.ts	Rego attendee session required.	partners-api/src/routes/socialIdentityLink.ts:159
GET	/api/rego/social/identity-link	socialIdentityLink.ts	Rego attendee session required.	partners-api/src/routes/socialIdentityLink.ts:120
POST	/api/rego/social/identity-link/redeem	socialIdentityLink.ts	Rego attendee session required.	partners-api/src/routes/socialIdentityLink.ts:128
GET	/api/social-publishing/oauth/:network/callback	socialPublishing.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialPublishing.ts:180
POST	/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:153
POST	/api/social-publishing/partners/:partnerId/accounts/discord-webhook	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:260
POST	/api/social-publishing/partners/:partnerId/accounts/telegram	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:283
GET	/api/social-publishing/partners/:partnerId/overview	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:226
POST	/api/social-publishing/partners/:partnerId/posts	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:304
POST	/api/social-publishing/partners/:partnerId/posts/:postId/queue	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:397
POST	/api/social/account/deactivate	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:751
GET	/api/social/account/export	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:726
POST	/api/social/advertising/campaigns/:campaignId/hide	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1681
POST	/api/social/advertising/campaigns/:campaignId/report	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1703
POST	/api/social/advertising/signals	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:134
GET	/api/social/channels	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1437
POST	/api/social/channels	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1546
PUT	/api/social/channels/:slug/membership	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1593
GET	/api/social/channels/:slug/posts	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1626
GET	/api/social/custom-emojis	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1461
POST	/api/social/custom-emojis	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1481
PATCH	/api/social/custom-emojis/:shortcode	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1523
DELETE	/api/social/discovery/preferences	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3087
GET	/api/social/discovery/preferences	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3057
PUT	/api/social/discovery/preferences	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3068
GET	/api/social/event-disclosure	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2469
PUT	/api/social/event-disclosure	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2488
PUT	/api/social/event-discovery/:eventId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3353
POST	/api/social/event-page-verifications/:requestId/decisions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4473
GET	/api/social/events/:eventId/event-page-verification	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4419
POST	/api/social/events/:eventId/event-page-verifications/:requestId/admin-handoff	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4521
DELETE	/api/social/events/:eventId/rsvp	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3239
PUT	/api/social/events/:eventId/rsvp	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3218
DELETE	/api/social/events/:eventId/saved	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3191
PUT	/api/social/events/:eventId/saved	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3178
GET	/api/social/events/rsvps	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3206
GET	/api/social/events/saved	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3100
DELETE	/api/social/identity-link	socialIdentityLink.ts	Partner dashboard session required.	partners-api/src/routes/socialIdentityLink.ts:104
GET	/api/social/identity-link	socialIdentityLink.ts	Partner dashboard session required.	partners-api/src/routes/socialIdentityLink.ts:58
POST	/api/social/identity-link/challenges	socialIdentityLink.ts	Partner dashboard session required.	partners-api/src/routes/socialIdentityLink.ts:73
POST	/api/social/internal/event-discovery	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:3377
GET	/api/social/me/partner-event-links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3680
PUT	/api/social/me/partner-event-links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3696
GET	/api/social/media/:mediaAssetId/content	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:4928
POST	/api/social/media/images	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4627
GET	/api/social/media/ready	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4906
POST	/api/social/media/rich	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4787
GET	/api/social/meetups/sessions	socialMeetup.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialMeetup.ts:66
DELETE	/api/social/meetups/sessions/:id	socialMeetup.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialMeetup.ts:80
POST	/api/social/moderation-appeals	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2378
GET	/api/social/moderation/access	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5755
GET	/api/social/moderation/activity	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6610
POST	/api/social/moderation/activity/:activityId/review	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6644
GET	/api/social/moderation/analytics	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5953
GET	/api/social/moderation/appeals	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7097
POST	/api/social/moderation/appeals/:appealId/actions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7222
GET	/api/social/moderation/assignees	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6784
GET	/api/social/moderation/audit	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5973
GET	/api/social/moderation/audit/export	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5875
GET	/api/social/moderation/audit/operations	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5922
GET	/api/social/moderation/bootstrap	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6484
GET	/api/social/moderation/cases/:caseId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6683
POST	/api/social/moderation/cases/:caseId/actions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6897
POST	/api/social/moderation/cases/:caseId/assignment	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6793
POST	/api/social/moderation/cases/:caseId/escalations	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6825
POST	/api/social/moderation/cases/:caseId/legal-holds	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7114
POST	/api/social/moderation/cases/:caseId/links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6883
POST	/api/social/moderation/cases/:caseId/member-notices	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7039
POST	/api/social/moderation/cases/:caseId/notes	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7249
POST	/api/social/moderation/cases/:caseId/organization	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6809
POST	/api/social/moderation/cases/:caseId/retention-purges	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7186
GET	/api/social/moderation/cases/:caseId/retention-review	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7145
POST	/api/social/moderation/cases/:caseId/signal-feedback	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6764
POST	/api/social/moderation/cases/:caseId/signals/:signalId/acknowledge	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6746
POST	/api/social/moderation/cases/bulk-organization	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6865
GET	/api/social/moderation/escalations	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6840
POST	/api/social/moderation/escalations/:escalationId/resolve	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6848
POST	/api/social/moderation/handoffs	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7274
POST	/api/social/moderation/handoffs/:pointer/redeem	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7321
POST	/api/social/moderation/legal-holds/:holdId/release	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7128
GET	/api/social/moderation/link-policies	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6067
POST	/api/social/moderation/link-policies	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6093
POST	/api/social/moderation/link-policies/:policyId/disable	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6133
POST	/api/social/moderation/media-hash-policies	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6372
POST	/api/social/moderation/media-hash-policies/:policyId/disable	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6395
GET	/api/social/moderation/media-quarantines	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6338
POST	/api/social/moderation/media-quarantines/:quarantineId/release	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6412
GET	/api/social/moderation/note-eligible-staff	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7264
POST	/api/social/moderation/quick-page-actions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7005
POST	/api/social/moderation/quick-post-actions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6941
POST	/api/social/moderation/quick-profile-actions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6972
GET	/api/social/moderation/registration-invites	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5768
POST	/api/social/moderation/registration-invites	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5785
DELETE	/api/social/moderation/registration-invites/:inviteId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5810
GET	/api/social/moderation/response-templates	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7066
POST	/api/social/moderation/response-templates	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7074
DELETE	/api/social/moderation/response-templates/:templateId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7085
POST	/api/social/moderation/retention-purges/:requestId/approve	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:7207
GET	/api/social/moderation/rich-media-reviews	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6429
POST	/api/social/moderation/rich-media-reviews/:reviewItemId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6456
GET	/api/social/moderation/staff	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5829
DELETE	/api/social/moderation/staff/:staffUserId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6040
PUT	/api/social/moderation/staff/:staffUserId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6000
GET	/api/social/moderation/staff/audit	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5852
GET	/api/social/moderation/text-policies	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6156
POST	/api/social/moderation/text-policies	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6192
POST	/api/social/moderation/text-policies/:policyId/disable	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6220
GET	/api/social/moderation/text-policies/:policyId/exceptions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6238
POST	/api/social/moderation/text-policies/:policyId/exceptions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6267
POST	/api/social/moderation/text-policies/:policyId/exceptions/:exceptionId/disable	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6304
POST	/api/social/moderation/text-policies/simulate	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:6173
GET	/api/social/notification-preferences	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2327
PUT	/api/social/notification-preferences	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2343
GET	/api/social/notifications	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2242
POST	/api/social/notifications/read	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2278
POST	/api/social/page-admin-handoffs/:pointer/redeem	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4548
GET	/api/social/page-invitations	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4593
POST	/api/social/page-invitations/:invitationId/accept	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4609
GET	/api/social/pages	socialPageDiscovery.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialPageDiscovery.ts:8
POST	/api/social/pages	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3724
GET	/api/social/pages/:slug	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:3751
PATCH	/api/social/pages/:slug	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3806
POST	/api/social/pages/:slug/announcements	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4030
PUT	/api/social/pages/:slug/announcements/:announcementId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4052
POST	/api/social/pages/:slug/announcements/:announcementId/approve	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4099
POST	/api/social/pages/:slug/announcements/:announcementId/publish	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4100
POST	/api/social/pages/:slug/announcements/:announcementId/withdraw	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4101
GET	/api/social/pages/:slug/announcements/workflow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4019
POST	/api/social/pages/:slug/archive	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3853
GET	/api/social/pages/:slug/drafts	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4103
POST	/api/social/pages/:slug/drafts	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4116
DELETE	/api/social/pages/:slug/drafts/:draftId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4159
PUT	/api/social/pages/:slug/drafts/:draftId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4135
POST	/api/social/pages/:slug/event-verification-requests	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4377
DELETE	/api/social/pages/:slug/follow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4282
GET	/api/social/pages/:slug/follow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4296
PUT	/api/social/pages/:slug/follow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4262
POST	/api/social/pages/:slug/invitations	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4313
GET	/api/social/pages/:slug/members	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4239
DELETE	/api/social/pages/:slug/members/:username	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4347
GET	/api/social/pages/:slug/notifications	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4194
POST	/api/social/pages/:slug/notifications/read	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4218
POST	/api/social/pages/:slug/ownership/relinquish	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3912
GET	/api/social/pages/:slug/partner-event-links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3643
PUT	/api/social/pages/:slug/partner-event-links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3654
POST	/api/social/pages/:slug/reports	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2783
POST	/api/social/pages/:slug/restore	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3882
GET	/api/social/pages/mine	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3531
GET	/api/social/posts	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1729
POST	/api/social/posts	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5046
DELETE	/api/social/posts/:postId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5316
PATCH	/api/social/posts/:postId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5235
DELETE	/api/social/posts/:postId/bookmark	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5391
PUT	/api/social/posts/:postId/bookmark	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5377
DELETE	/api/social/posts/:postId/custom-emoji-reactions/:shortcode	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5525
POST	/api/social/posts/:postId/media	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:4987
POST	/api/social/posts/:postId/poll-votes	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5405
POST	/api/social/posts/:postId/reactions	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5449
DELETE	/api/social/posts/:postId/reactions/:reaction	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5498
POST	/api/social/posts/:postId/reports	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5701
DELETE	/api/social/posts/:postId/repost	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5363
PUT	/api/social/posts/:postId/repost	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5343
GET	/api/social/posts/:postId/revisions	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:5291
GET	/api/social/posts/:postId/thread	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1944
GET	/api/social/posts/following	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1841
GET	/api/social/posts/friends	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:1910
GET	/api/social/profiles	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:2984
GET	/api/social/profiles/:username	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:2627
GET	/api/social/profiles/:username/events	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:2529
DELETE	/api/social/profiles/:username/follow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2434
PUT	/api/social/profiles/:username/follow	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2402
POST	/api/social/profiles/:username/reports	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2756
PATCH	/api/social/profiles/me/bio	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2809
PATCH	/api/social/profiles/me/expression	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2847
PUT	/api/social/profiles/me/links	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2870
PUT	/api/social/profiles/me/media	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2920
PUT	/api/social/profiles/me/pinned-post	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2895
GET	/api/social/public/events	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:3256
GET	/api/social/public/events/:eventId/event-page	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:4583
GET	/api/social/relationships/following	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2000
GET	/api/social/relationships/friends	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2056
DELETE	/api/social/relationships/friends/:friendshipId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2172
PATCH	/api/social/relationships/friends/:friendshipId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2147
POST	/api/social/relationships/friends/:friendshipId/block-everywhere	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2196
POST	/api/social/relationships/friends/:friendshipId/unblock-everywhere	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2219
GET	/api/social/relationships/friends/requests	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2079
POST	/api/social/relationships/friends/requests	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2100
GET	/api/social/relationships/friends/summary	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:2024
GET	/api/social/safety/controls	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5590
DELETE	/api/social/safety/controls/:username/:control	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5660
PUT	/api/social/safety/controls/:username/:control	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5615
GET	/api/social/safety/keyword-filters	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5546
POST	/api/social/safety/keyword-filters	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5559
DELETE	/api/social/safety/keyword-filters/:filterId	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:5577
DELETE	/api/social/staff/accounts/:accountId/partner-scope	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3627
PUT	/api/social/staff/accounts/:accountId/partner-scope	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3626
GET	/api/social/staff/cms-event-mappings	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3426
PUT	/api/social/staff/cms-events/:documentId/canonical-event	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3461
POST	/api/social/staff/event-discovery-webhook/reconcile	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3412
DELETE	/api/social/staff/pages/:pageId/partner-scope	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3625
PUT	/api/social/staff/pages/:pageId/partner-scope	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3624
GET	/api/social/staff/partner-scopes	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3556
GET	/api/social/staff/partner-scopes/subjects	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3575
GET	/api/social/starter-packs	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:3003
DELETE	/api/social/starter-packs/:slug	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3036
PUT	/api/social/starter-packs/:slug	socialNetwork.ts	Partner dashboard session required.	partners-api/src/routes/socialNetwork.ts:3016
GET	/api/social/topics/:topicId/posts	socialNetwork.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialNetwork.ts:1792
GET	/api/surveys	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:551
POST	/api/surveys	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:594
GET	/api/surveys/:surveyId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:834
PATCH	/api/surveys/:surveyId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:840
POST	/api/surveys/:surveyId/analysis	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1580
GET	/api/surveys/:surveyId/analytics	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1367
GET	/api/surveys/:surveyId/audit	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1513
POST	/api/surveys/:surveyId/duplicate	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:886
GET	/api/surveys/:surveyId/export.csv	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1200
GET	/api/surveys/:surveyId/export.json	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1231
GET	/api/surveys/:surveyId/export.xlsx	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1215
GET	/api/surveys/:surveyId/invitations	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:792
POST	/api/surveys/:surveyId/invitations	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:802
DELETE	/api/surveys/:surveyId/invitations/:invitationId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:820
POST	/api/surveys/:surveyId/lifecycle	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:918
POST	/api/surveys/:surveyId/publish	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:903
GET	/api/surveys/:surveyId/question-bank	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:686
POST	/api/surveys/:surveyId/question-bank	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:698
DELETE	/api/surveys/:surveyId/question-bank/:itemId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:713
GET	/api/surveys/:surveyId/report-schedules	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1327
POST	/api/surveys/:surveyId/report-schedules	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1337
PATCH	/api/surveys/:surveyId/report-schedules/:scheduleId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1349
GET	/api/surveys/:surveyId/reports	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1263
POST	/api/surveys/:surveyId/reports	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1272
GET	/api/surveys/:surveyId/reports/:reportId/shares	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1287
POST	/api/surveys/:surveyId/reports/:reportId/shares	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1297
DELETE	/api/surveys/:surveyId/reports/:reportId/shares/:shareId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1316
GET	/api/surveys/:surveyId/responses	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1168
GET	/api/surveys/:surveyId/responses/:responseId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1176
POST	/api/surveys/:surveyId/responses/:responseId/lifecycle	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1185
GET	/api/surveys/:surveyId/reward-claims	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1553
PATCH	/api/surveys/:surveyId/reward-claims/:claimId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1563
GET	/api/surveys/:surveyId/rewards	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1523
POST	/api/surveys/:surveyId/rewards	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1533
POST	/api/surveys/:surveyId/templates	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:870
GET	/api/surveys/:surveyId/webhook-deliveries	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:784
GET	/api/surveys/:surveyId/webhooks	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:740
POST	/api/surveys/:surveyId/webhooks	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:750
PATCH	/api/surveys/:surveyId/webhooks/:endpointId	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:767
GET	/api/surveys/account/:slug	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:950
GET	/api/surveys/account/:slug/recovery-context	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:967
POST	/api/surveys/account/:slug/submissions	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1093
GET	/api/surveys/analytics/summary	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1628
GET	/api/surveys/fph-staff-grants	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:626
POST	/api/surveys/fph-staff-grants	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:637
DELETE	/api/surveys/fph-staff-grants/:userId/:permission	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:652
GET	/api/surveys/invite/:token	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:984
POST	/api/surveys/invite/:token/submissions	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:1126
GET	/api/surveys/public-paths	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:727
GET	/api/surveys/public/:slug	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:936
POST	/api/surveys/public/:slug/events	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:997
PUT	/api/surveys/public/:slug/progress	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:1011
POST	/api/surveys/public/:slug/submissions	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:1037
POST	/api/surveys/responses/:responseId/no-perks	surveys.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/surveys.ts:1672
POST	/api/surveys/responses/:responseId/rewards/claim	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1660
GET	/api/surveys/scopes	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:574
GET	/api/surveys/shared-reports	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:1243
GET	/api/surveys/templates	surveys.ts	Partner dashboard session required.	partners-api/src/routes/surveys.ts:664
POST	/api/v2/admissions	v2Admission.ts	Partner dashboard session required.	partners-api/src/routes/v2Admission.ts:16
DELETE	/api/v2/admissions/:membershipId	v2Admission.ts	Partner dashboard session required.	partners-api/src/routes/v2Admission.ts:27
GET	/api/v2/profile	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:24
PUT	/api/v2/profile	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:25
POST	/api/v2/profile/legal-acceptances	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:35
PATCH	/api/v2/profile/notification-preferences	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:33
POST	/api/v2/profile/phone/validate	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:30
PATCH	/api/v2/profile/photo	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:34
PATCH	/api/v2/profile/username	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:32
GET	/api/v2/profile/username/check	v2Profile.ts	Partner dashboard session required.	partners-api/src/routes/v2Profile.ts:31
POST	/hooks/discord-finance	financeInteractions.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/financeInteractions.ts:31
POST	/public/site-reports	siteReports.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/siteReports.ts:53
GET	/public/site-reports/config	siteReports.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/siteReports.ts:25
GET	/public/site-reports/identity	siteReports.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/siteReports.ts:33
GET	/public/site-reports/widget.js	siteReports.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/siteReports.ts:18
GET	/api/events/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:819
PUT	/api/events/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:843
GET	/api/events/:id/rego-gifts	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:2144
POST	/api/events/:id/rego-gifts/:giftId/payment-review	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:2166
POST	/api/events/:id/reserve-slot	regoReservations.ts	Rego attendee session required.	partners-api/src/routes/regoReservations.ts:12
GET	/api/events/:id/waitlist-config	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:263
PUT	/api/events/:id/waitlist-config/:subjectType/:subjectId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:298
POST	/api/events/:id/waitlist/process-next/:tierId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:388
POST	/api/internal/waitlist/expire-offers	waitlist.ts	Internal cron secret required.	partners-api/src/routes/waitlist.ts:542
GET	/api/manage/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:819
PUT	/api/manage/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:843
GET	/api/manage/:id/rego-gifts	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:2144
POST	/api/manage/:id/rego-gifts/:giftId/payment-review	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:2166
POST	/api/manage/:id/reserve-slot	regoReservations.ts	Rego attendee session required.	partners-api/src/routes/regoReservations.ts:12
GET	/api/manage/:id/waitlist-config	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:263
PUT	/api/manage/:id/waitlist-config/:subjectType/:subjectId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:298
POST	/api/manage/:id/waitlist/process-next/:tierId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:388
POST	/api/rego-reservations/:id/release	regoReservations.ts	Rego attendee session required.	partners-api/src/routes/regoReservations.ts:36
GET	/api/rego/affiliate-rewards	regoAffiliateRewards.ts	Rego attendee session required.	partners-api/src/routes/regoAffiliateRewards.ts:18
PUT	/api/rego/affiliate-rewards/:affiliateId/payout	regoAffiliateRewards.ts	Rego attendee session required.	partners-api/src/routes/regoAffiliateRewards.ts:30
GET	/api/rego/events	rego.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rego.ts:1187
GET	/api/rego/events/:slug	rego.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rego.ts:1279
GET	/api/rego/events/:slug/gift/recipient	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1663
GET	/api/rego/fursonas	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:69
POST	/api/rego/fursonas	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:90
DELETE	/api/rego/fursonas/:id	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:195
PUT	/api/rego/fursonas/:id	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:136
DELETE	/api/rego/fursonas/:id/refs	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:282
POST	/api/rego/fursonas/:id/refs	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:232
PUT	/api/rego/fursonas/:id/refs/latest	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:332
POST	/api/rego/gifts	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1783
GET	/api/rego/gifts/:id	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2113
POST	/api/rego/gifts/:id/redeem	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2136
GET	/api/rego/gifts/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2089
POST	/api/rego/gifts/quote	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1712
POST	/api/rego/groups	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:245
GET	/api/rego/groups/:id	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:397
PATCH	/api/rego/groups/:id/accept	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:552
PATCH	/api/rego/groups/:id/cancel	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:566
PATCH	/api/rego/groups/:id/decline	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:559
POST	/api/rego/groups/:id/invite	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:440
DELETE	/api/rego/groups/:id/members/:memberId	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:648
PATCH	/api/rego/groups/:id/members/:memberId	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:598
POST	/api/rego/groups/:id/submit	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:3328
GET	/api/rego/groups/:id/totals	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:685
GET	/api/rego/groups/my	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:339
POST	/api/rego/internal/archive-expired	rego.ts	Internal cron secret required.	partners-api/src/routes/rego.ts:4250
POST	/api/rego/payment-link-reference	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1482
PUT	/api/rego/prefills	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:2270
DELETE	/api/rego/prefills/:eventId	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2476
GET	/api/rego/prefills/:eventId	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2234
POST	/api/rego/quote	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:1557
POST	/api/rego/regos	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:2832
GET	/api/rego/regos/:ref	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2570
GET	/api/rego/regos/:ref/wallet	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2762
GET	/api/rego/regos/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2502
POST	/api/rego/waitlist	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:4160
POST	/api/rego/waitlist/:entryId/accept	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:516
POST	/api/rego/waitlist/:entryId/decline	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:431
GET	/api/rego/waitlist/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:4118
GET	/api/rego/waitlist/pending-offer	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:413
GET	/api/events/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1862
PATCH	/api/events/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1903
GET	/api/events/:id/social/discord/guilds	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1744
GET	/api/events/:id/social/discord/guilds/:guildId/roles	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1765
GET	/api/events/:id/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1668
GET	/api/events/:id/social/telegram/chats	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1801
POST	/api/events/:id/social/telegram/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1929
GET	/api/events/:id/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1698
GET	/api/events/:id/zep/app-bundle	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:484
GET	/api/events/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:422
PUT	/api/events/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:501
POST	/api/internal/social-entitlements/reconcile	socialLinking.ts	Internal cron secret required.	partners-api/src/routes/socialLinking.ts:2288
GET	/api/manage/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1862
PATCH	/api/manage/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1903
GET	/api/manage/:id/social/discord/guilds	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1744
GET	/api/manage/:id/social/discord/guilds/:guildId/roles	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1765
GET	/api/manage/:id/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1668
GET	/api/manage/:id/social/telegram/chats	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1801
POST	/api/manage/:id/social/telegram/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1929
GET	/api/manage/:id/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1698
GET	/api/manage/:id/zep/app-bundle	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:484
GET	/api/manage/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:422
PUT	/api/manage/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:501
DELETE	/api/org/social/discord/guilds/:guildId	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1822
GET	/api/org/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1492
POST	/api/org/social/discord/unlink	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1522
GET	/api/org/social/settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1452
POST	/api/org/social/telegram/chat/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1642
GET	/api/org/social/telegram/chat/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1600
DELETE	/api/org/social/telegram/chats/:chatId	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1842
GET	/api/org/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1544
POST	/api/org/social/telegram/unlink	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1578
GET	/api/rego/friends	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:250
DELETE	/api/rego/friends/:id	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:619
PATCH	/api/rego/friends/:id/accept	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:456
POST	/api/rego/friends/:id/block-everywhere	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:743
PATCH	/api/rego/friends/:id/decline	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:537
POST	/api/rego/friends/:id/unblock-everywhere	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:768
GET	/api/rego/friends/events	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:795
POST	/api/rego/friends/request	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:368
GET	/api/rego/friends/requests	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:308
GET	/api/rego/friends/sent	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:338
GET	/api/rego/friends/summary	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:221
GET	/api/rego/social/discord/link/start	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1346
POST	/api/rego/social/discord/unlink	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1402
GET	/api/rego/social/settings	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:78
PATCH	/api/rego/social/settings	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:101
GET	/api/rego/social/telegram/link/start	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1372
POST	/api/rego/social/telegram/unlink	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1427
GET	/api/rego/users/search	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:149
POST	/api/rego/zep/launch	zep.ts	Rego attendee session required.	partners-api/src/routes/zep.ts:695
GET	/api/rego/zep/status	zep.ts	Rego attendee session required.	partners-api/src/routes/zep.ts:680
POST	/api/zep/validate	zep.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/zep.ts:728
POST	/hooks/telegram	socialLinking.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/socialLinking.ts:1059
POST	/contact	contact.ts	Public route with validation and outbound mail behavior.	partners-api/src/routes/contact.ts:28

Endpoint contracts

1. GET /api/admin/attendees

• Purpose: GET /api/admin/attendees handled by staffProfiles.ts; admin attendees route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:475
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/attendees" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/attendees", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

2. DELETE /api/admin/attendees/:attendeeAccountId/incomplete-profile

• Purpose: DELETE /api/admin/attendees/:attendeeAccountId/incomplete-profile handled by staffProfiles.ts; admin attendees attendeeAccountId incomplete profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:381
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: attendeeAccountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/attendees/:attendeeAccountId/incomplete-profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/attendees/:attendeeAccountId/incomplete-profile", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

3. DELETE /api/admin/attendees/disposable-test-identities

• Purpose: DELETE /api/admin/attendees/disposable-test-identities handled by staffProfiles.ts; admin attendees disposable test identities route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:290
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/attendees/disposable-test-identities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/attendees/disposable-test-identities", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

4. POST /api/admin/attendees/disposable-test-identities

• Purpose: POST /api/admin/attendees/disposable-test-identities handled by staffProfiles.ts; admin attendees disposable test identities route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:263
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/attendees/disposable-test-identities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/attendees/disposable-test-identities", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

5. GET /api/admin/user-profiles

• Purpose: GET /api/admin/user-profiles handled by staffProfiles.ts; admin user profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:173
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/user-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/user-profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

6. POST /api/events

• Purpose: POST /api/events handled by mutations.ts; events route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:159
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

7. GET /api/events/:id

• Purpose: GET /api/events/:id handled by rows.ts; events id route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:399
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

8. PUT /api/events/:id

• Purpose: PUT /api/events/:id handled by mutations.ts; events id route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:245
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

9. GET /api/events/check-rego-ref-prefix

• Purpose: GET /api/events/check-rego-ref-prefix handled by mutations.ts; events check rego ref prefix route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:204
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/check-rego-ref-prefix" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/check-rego-ref-prefix", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

10. GET /api/img/:filename

• Purpose: GET /api/img/:filename handled by imgProxy.ts; img filename route contract must be verified against source before integration.
• Source: partners-api/src/routes/imgProxy.ts:63
• Mounted prefix: /api
• Route module: imgProxy.ts
• Router variable: router
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: filename
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/img/:filename" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/img/:filename", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

11. POST /api/incidents

• Purpose: POST /api/incidents handled by mutations.ts; incidents route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:579
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/incidents" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

12. PUT /api/incidents/:id

• Purpose: PUT /api/incidents/:id handled by mutations.ts; incidents id route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:618
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/incidents/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

13. PATCH /api/incidents/:id/actions

• Purpose: PATCH /api/incidents/:id/actions handled by mutations.ts; incidents id actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:684
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/incidents/:id/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id/actions", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

14. POST /api/incidents/:id/cross-ban-decision

• Purpose: POST /api/incidents/:id/cross-ban-decision handled by mutations.ts; incidents id cross ban decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:840
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/incidents/:id/cross-ban-decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id/cross-ban-decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

15. POST /api/internal/test-runs

• Purpose: POST /api/internal/test-runs handled by testRuns.ts; internal test runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1764
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

16. DELETE /api/internal/test-runs/:runId/assets

• Purpose: DELETE /api/internal/test-runs/:runId/assets handled by testRuns.ts; internal test runs runId assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3342
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/internal/test-runs/:runId/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/assets", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

17. POST /api/internal/test-runs/:runId/assets

• Purpose: POST /api/internal/test-runs/:runId/assets handled by testRuns.ts; internal test runs runId assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3314
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/assets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

18. POST /api/internal/test-runs/:runId/cleanup

• Purpose: POST /api/internal/test-runs/:runId/cleanup handled by testRuns.ts; internal test runs runId cleanup route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3148
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/cleanup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/cleanup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

19. POST /api/internal/test-runs/:runId/dashboard-session

• Purpose: POST /api/internal/test-runs/:runId/dashboard-session handled by testRuns.ts; internal test runs runId dashboard session route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1801
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/dashboard-session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/dashboard-session", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

20. POST /api/internal/test-runs/:runId/rego-sessions/bulk

• Purpose: POST /api/internal/test-runs/:runId/rego-sessions/bulk handled by testRuns.ts; internal test runs runId rego sessions bulk route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1829
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/rego-sessions/bulk" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/rego-sessions/bulk", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

21. DELETE /api/internal/test-runs/:runId/roots

• Purpose: DELETE /api/internal/test-runs/:runId/roots handled by testRuns.ts; internal test runs runId roots route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3292
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/internal/test-runs/:runId/roots" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/roots", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

22. POST /api/internal/test-runs/:runId/roots

• Purpose: POST /api/internal/test-runs/:runId/roots handled by testRuns.ts; internal test runs runId roots route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3263
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/roots" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/roots", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

23. POST /api/internal/test-runs/:runId/seed/event

• Purpose: POST /api/internal/test-runs/:runId/seed/event handled by testRuns.ts; internal test runs runId seed event route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2469
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/event" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/event", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

24. POST /api/internal/test-runs/:runId/seed/social-graph

• Purpose: POST /api/internal/test-runs/:runId/seed/social-graph handled by testRuns.ts; internal test runs runId seed social graph route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2211
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/social-graph" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/social-graph", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

25. POST /api/internal/test-runs/:runId/seed/staff

• Purpose: POST /api/internal/test-runs/:runId/seed/staff handled by testRuns.ts; internal test runs runId seed staff route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2039
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/staff" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/staff", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

26. GET /api/internal/test-runs/:runId/snapshot

• Purpose: GET /api/internal/test-runs/:runId/snapshot handled by testRuns.ts; internal test runs runId snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3364
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/internal/test-runs/:runId/snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

27. POST /api/internal/test-runs/:runId/social-withdrawal-snapshot

• Purpose: POST /api/internal/test-runs/:runId/social-withdrawal-snapshot handled by testRuns.ts; internal test runs runId social withdrawal snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2386
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/social-withdrawal-snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/social-withdrawal-snapshot", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

28. POST /api/internal/test-runs/:runId/state/fast-forward

• Purpose: POST /api/internal/test-runs/:runId/state/fast-forward handled by testRuns.ts; internal test runs runId state fast forward route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3065
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/state/fast-forward" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/state/fast-forward", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

29. POST /api/internal/test-runs/:runId/suppress-side-effects

• Purpose: POST /api/internal/test-runs/:runId/suppress-side-effects handled by testRuns.ts; internal test runs runId suppress side effects route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3237
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/suppress-side-effects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/suppress-side-effects", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

30. POST /api/internal/test-runs/:runId/verify

• Purpose: POST /api/internal/test-runs/:runId/verify handled by testRuns.ts; internal test runs runId verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3383
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

31. POST /api/internal/test-runs/:runId/withdraw-auth-identity

• Purpose: POST /api/internal/test-runs/:runId/withdraw-auth-identity handled by testRuns.ts; internal test runs runId withdraw auth identity route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2354
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/withdraw-auth-identity" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/withdraw-auth-identity", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

32. POST /api/internal/test-runs/sweep

• Purpose: POST /api/internal/test-runs/sweep handled by testRuns.ts; internal test runs sweep route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3196
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/sweep" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/sweep", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

33. POST /api/manage

• Purpose: POST /api/manage is the Event Management compatibility alias for /api/events.
• Source: partners-api/src/routes/mutations.ts:159
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

34. GET /api/manage/:id

• Purpose: GET /api/manage/:id is the Event Management compatibility alias for /api/events/:id.
• Source: partners-api/src/routes/rows.ts:399
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

35. PUT /api/manage/:id

• Purpose: PUT /api/manage/:id is the Event Management compatibility alias for /api/events/:id.
• Source: partners-api/src/routes/mutations.ts:245
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

36. GET /api/manage/check-rego-ref-prefix

• Purpose: GET /api/manage/check-rego-ref-prefix is the Event Management compatibility alias for /api/events/check-rego-ref-prefix.
• Source: partners-api/src/routes/mutations.ts:204
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/check-rego-ref-prefix" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/check-rego-ref-prefix", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

37. GET /api/media/:bucket/images/:filename

• Purpose: GET /api/media/:bucket/images/:filename handled by imgProxy.ts; media bucket images filename route contract must be verified against source before integration.
• Source: partners-api/src/routes/imgProxy.ts:64
• Mounted prefix: /api
• Route module: imgProxy.ts
• Router variable: router
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: bucket, filename
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/media/:bucket/images/:filename" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/media/:bucket/images/:filename", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

38. GET /api/partner-directory

• Purpose: GET /api/partner-directory handled by rows.ts; partner directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:1187
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

39. POST /api/pawsports/bind

• Purpose: POST /api/pawsports/bind handled by mutations.ts; pawsports bind route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:477
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/bind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/bind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

40. GET /api/person-profiles

• Purpose: GET /api/person-profiles handled by personProfiles.ts; person profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:18
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/person-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

41. POST /api/person-profiles

• Purpose: POST /api/person-profiles handled by personProfiles.ts; person profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:77
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/person-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

42. DELETE /api/person-profiles/:id

• Purpose: DELETE /api/person-profiles/:id handled by personProfiles.ts; person profiles id route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:152
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/person-profiles/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

43. PUT /api/person-profiles/:id

• Purpose: PUT /api/person-profiles/:id handled by personProfiles.ts; person profiles id route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:125
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/person-profiles/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

44. POST /api/person-profiles/:id/links

• Purpose: POST /api/person-profiles/:id/links handled by personProfiles.ts; person profiles id links route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:171
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/person-profiles/:id/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id/links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

45. DELETE /api/person-profiles/:id/links/:reportId

• Purpose: DELETE /api/person-profiles/:id/links/:reportId handled by personProfiles.ts; person profiles id links reportId route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:204
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, reportId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/person-profiles/:id/links/:reportId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id/links/:reportId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

46. GET /api/platform-fees

• Purpose: GET /api/platform-fees handled by rows.ts; platform fees route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:1245
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/platform-fees" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/platform-fees", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

47. GET /api/rego/event-regos/:eventId

• Purpose: GET /api/rego/event-regos/:eventId handled by rows.ts; rego event regos eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:524
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/event-regos/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/event-regos/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

48. GET /api/rego/event-waitlist/:eventId

• Purpose: GET /api/rego/event-waitlist/:eventId handled by rows.ts; rego event waitlist eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:654
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/event-waitlist/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/event-waitlist/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

49. POST /api/rego/upload-image

• Purpose: POST /api/rego/upload-image handled by uploadImage.ts; rego upload image route contract must be verified against source before integration.
• Source: partners-api/src/routes/uploadImage.ts:230
• Mounted prefix: /api
• Route module: uploadImage.ts
• Router variable: app
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/upload-image" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/upload-image", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

50. PATCH /api/regos/:id/payment-status

• Purpose: PATCH /api/regos/:id/payment-status handled by rows.ts; regos id payment status route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:713
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/regos/:id/payment-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:id/payment-status", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

51. POST /api/regos/:regId/email

• Purpose: POST /api/regos/:regId/email handled by rows.ts; regos regId email route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:885
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/regos/:regId/email" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:regId/email", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

52. POST /api/regos/:regId/email-preview

• Purpose: POST /api/regos/:regId/email-preview handled by rows.ts; regos regId email preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:1000
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/regos/:regId/email-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:regId/email-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

53. GET /api/rows

• Purpose: GET /api/rows handled by rows.ts; rows route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:116
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rows" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rows", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

54. GET /api/spa/contracts

• Purpose: GET /api/spa/contracts handled by spaContracts.ts; spa contracts route contract must be verified against source before integration.
• Source: partners-api/src/routes/spaContracts.ts:72
• Mounted prefix: /api
• Route module: spaContracts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/spa/contracts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/spa/contracts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

55. POST /api/upload-image

• Purpose: POST /api/upload-image handled by uploadImage.ts; upload image route contract must be verified against source before integration.
• Source: partners-api/src/routes/uploadImage.ts:229
• Mounted prefix: /api
• Route module: uploadImage.ts
• Router variable: app
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/upload-image" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/upload-image", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

56. POST /api/watchlist/adoptions

• Purpose: POST /api/watchlist/adoptions handled by mutations.ts; watchlist adoptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:775
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/adoptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/adoptions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

57. POST /api/watchlist/grants

• Purpose: POST /api/watchlist/grants handled by mutations.ts; watchlist grants route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:740
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/grants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/grants", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

58. POST /api/watchlist/master-requests

• Purpose: POST /api/watchlist/master-requests handled by mutations.ts; watchlist master requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:809
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/master-requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/master-requests", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

59. POST /api/admin/discord/messages

• Purpose: POST /api/admin/discord/messages handled by adminDiscord.ts; admin discord messages route contract must be verified against source before integration.
• Source: partners-api/src/routes/adminDiscord.ts:49
• Mounted prefix: /api
• Route module: adminDiscord.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/discord/messages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/discord/messages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

60. GET /api/admin/discord/targets

• Purpose: GET /api/admin/discord/targets handled by adminDiscord.ts; admin discord targets route contract must be verified against source before integration.
• Source: partners-api/src/routes/adminDiscord.ts:11
• Mounted prefix: /api
• Route module: adminDiscord.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/discord/targets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/discord/targets", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

61. DELETE /api/admin/events/:eventId/registrations

• Purpose: DELETE /api/admin/events/:eventId/registrations handled by admin.ts; admin events eventId registrations route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:976
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/events/:eventId/registrations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/events/:eventId/registrations", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

62. GET /api/admin/members

• Purpose: GET /api/admin/members handled by admin.ts; admin members route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:183
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/members" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

63. POST /api/admin/members

• Purpose: POST /api/admin/members handled by admin.ts; admin members route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:214
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/members" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

64. DELETE /api/admin/members/:membershipId

• Purpose: DELETE /api/admin/members/:membershipId handled by admin.ts; admin members membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:321
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/members/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members/:membershipId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

65. PATCH /api/admin/members/:membershipId

• Purpose: PATCH /api/admin/members/:membershipId handled by admin.ts; admin members membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:383
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/members/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members/:membershipId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

66. GET /api/admin/notices

• Purpose: GET /api/admin/notices handled by notices.ts; admin notices route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:218
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/notices" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

67. POST /api/admin/notices

• Purpose: POST /api/admin/notices handled by notices.ts; admin notices route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:236
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/notices" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

68. PATCH /api/admin/notices/:id

• Purpose: PATCH /api/admin/notices/:id handled by notices.ts; admin notices id route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:350
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/notices/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices/:id", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

69. GET /api/admin/partners

• Purpose: GET /api/admin/partners handled by admin.ts; admin partners route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:63
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/partners" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

70. POST /api/admin/partners

• Purpose: POST /api/admin/partners handled by admin.ts; admin partners route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:78
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/partners" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

71. PATCH /api/admin/partners/:partnerId

• Purpose: PATCH /api/admin/partners/:partnerId handled by admin.ts; admin partners partnerId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:121
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/partners/:partnerId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners/:partnerId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

72. POST /api/admin/partners/:partnerId/cms-token

• Purpose: POST /api/admin/partners/:partnerId/cms-token handled by admin.ts; admin partners partnerId cms token route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:465
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/partners/:partnerId/cms-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners/:partnerId/cms-token", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

73. GET /api/admin/platform-fee

• Purpose: GET /api/admin/platform-fee handled by admin.ts; admin platform fee route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:612
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-fee" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-fee", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

74. PATCH /api/admin/platform-fee

• Purpose: PATCH /api/admin/platform-fee handled by admin.ts; admin platform fee route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:625
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/platform-fee" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-fee", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

75. GET /api/admin/platform-security

• Purpose: GET /api/admin/platform-security handled by admin.ts; admin platform security route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:932
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-security" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-security", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

76. PATCH /api/admin/platform-security

• Purpose: PATCH /api/admin/platform-security handled by admin.ts; admin platform security route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:942
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/platform-security" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-security", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

77. PUT /api/admin/settlement-payment-providers

• Purpose: PUT /api/admin/settlement-payment-providers handled by admin.ts; admin settlement payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:798
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/admin/settlement-payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

78. GET /api/admin/settlement-settings

• Purpose: GET /api/admin/settlement-settings handled by admin.ts; admin settlement settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:676
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/settlement-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

79. PATCH /api/admin/settlement-settings

• Purpose: PATCH /api/admin/settlement-settings handled by admin.ts; admin settlement settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:714
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/settlement-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

80. GET /api/network-bans/:watchlistEntryId

• Purpose: GET /api/network-bans/:watchlistEntryId handled by networkBans.ts; network bans watchlistEntryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:218
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

81. PATCH /api/network-bans/:watchlistEntryId/appeal

• Purpose: PATCH /api/network-bans/:watchlistEntryId/appeal handled by networkBans.ts; network bans watchlistEntryId appeal route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:522
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

82. POST /api/network-bans/:watchlistEntryId/appeal

• Purpose: POST /api/network-bans/:watchlistEntryId/appeal handled by networkBans.ts; network bans watchlistEntryId appeal route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:277
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

83. GET /api/network-bans/:watchlistEntryId/appeal-status

• Purpose: GET /api/network-bans/:watchlistEntryId/appeal-status handled by networkBans.ts; network bans watchlistEntryId appeal status route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:357
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal-status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

84. GET /api/network-bans/:watchlistEntryId/appeals

• Purpose: GET /api/network-bans/:watchlistEntryId/appeals handled by networkBans.ts; network bans watchlistEntryId appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:417
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

85. GET /api/network-bans/appeals

• Purpose: GET /api/network-bans/appeals handled by networkBans.ts; network bans appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:14
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

86. POST /api/network-bans/appeals/:appealId/decision

• Purpose: POST /api/network-bans/appeals/:appealId/decision handled by networkBans.ts; network bans appeals appealId decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:94
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appealId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/network-bans/appeals/:appealId/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/appeals/:appealId/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

87. GET /api/network-bans/my-appeals

• Purpose: GET /api/network-bans/my-appeals handled by networkBans.ts; network bans my appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:154
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/my-appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/my-appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

88. POST /api/notices/:id/ack

• Purpose: POST /api/notices/:id/ack handled by notices.ts; notices id ack route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:192
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/notices/:id/ack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/notices/:id/ack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

89. GET /api/notices/unacked

• Purpose: GET /api/notices/unacked handled by notices.ts; notices unacked route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:133
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/notices/unacked" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/notices/unacked", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

90. GET /api/org/settings

• Purpose: GET /api/org/settings handled by orgSettings.ts; org settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:86
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

91. PATCH /api/org/settings

• Purpose: PATCH /api/org/settings handled by orgSettings.ts; org settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:113
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/org/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

92. POST /api/org/settings/data-silo/backfill

• Purpose: POST /api/org/settings/data-silo/backfill handled by orgSettings.ts; org settings data silo backfill route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:207
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/settings/data-silo/backfill" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings/data-silo/backfill", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

93. GET /api/access

• Purpose: GET /api/access handled by access.ts; access route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:32
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

94. GET /api/cms-token

• Purpose: GET /api/cms-token handled by access.ts; cms token route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:291
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/cms-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/cms-token", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

95. GET /api/partner-directory

• Purpose: GET /api/partner-directory handled by access.ts; partner directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:268
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

96. GET /api/partner-permissions

• Purpose: GET /api/partner-permissions handled by access.ts; partner permissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:188
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-permissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-permissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

97. PUT /api/partner-permissions/members/:userId

• Purpose: PUT /api/partner-permissions/members/:userId handled by access.ts; partner permissions members userId route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:205
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: userId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partner-permissions/members/:userId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-permissions/members/:userId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

98. POST /auth/accept-invite

• Purpose: POST /auth/accept-invite handled by auth.ts; auth accept invite route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:953
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/accept-invite" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/accept-invite", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

99. POST /auth/change-password

• Purpose: POST /auth/change-password handled by auth.ts; auth change password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:864
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/change-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/change-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

100. POST /auth/dev-session

• Purpose: POST /auth/dev-session handled by auth.ts; auth dev session route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:726
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/dev-session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/dev-session", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

101. POST /auth/exchange

• Purpose: POST /auth/exchange handled by auth.ts; auth exchange route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:832
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/exchange" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/exchange", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

102. GET /auth/mfa/status

• Purpose: GET /auth/mfa/status handled by auth.ts; auth mfa status route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:558
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/auth/mfa/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

103. POST /auth/mfa/totp/enroll

• Purpose: POST /auth/mfa/totp/enroll handled by auth.ts; auth mfa totp enroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:614
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/enroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/enroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

104. POST /auth/mfa/totp/unenroll

• Purpose: POST /auth/mfa/totp/unenroll handled by auth.ts; auth mfa totp unenroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:688
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/unenroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/unenroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

105. POST /auth/mfa/totp/verify

• Purpose: POST /auth/mfa/totp/verify handled by auth.ts; auth mfa totp verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:645
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

106. POST /auth/otp/send

• Purpose: POST /auth/otp/send handled by auth.ts; auth otp send route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:376
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/otp/send" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/otp/send", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

107. POST /auth/otp/verify

• Purpose: POST /auth/otp/verify handled by auth.ts; auth otp verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:417
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/otp/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/otp/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

108. POST /auth/passkey/authentication/options

• Purpose: POST /auth/passkey/authentication/options handled by auth.ts; auth passkey authentication options route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:459
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/authentication/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/authentication/options", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

109. POST /auth/passkey/authentication/verify

• Purpose: POST /auth/passkey/authentication/verify handled by auth.ts; auth passkey authentication verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:478
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/authentication/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/authentication/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

110. POST /auth/passkey/registration/options

• Purpose: POST /auth/passkey/registration/options handled by auth.ts; auth passkey registration options route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:507
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/registration/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/registration/options", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

111. POST /auth/passkey/registration/verify

• Purpose: POST /auth/passkey/registration/verify handled by auth.ts; auth passkey registration verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:528
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/registration/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/registration/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

112. POST /auth/recovery-session

• Purpose: POST /auth/recovery-session handled by auth.ts; auth recovery session route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1323
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/recovery-session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/recovery-session", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

113. POST /auth/refresh

• Purpose: POST /auth/refresh handled by auth.ts; auth refresh route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:785
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/refresh" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/refresh", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

114. POST /auth/reset-password

• Purpose: POST /auth/reset-password handled by auth.ts; auth reset password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1289
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/reset-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/reset-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

115. POST /auth/set-password

• Purpose: POST /auth/set-password handled by auth.ts; auth set password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1338
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/set-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/set-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

116. POST /auth/sign-in

• Purpose: POST /auth/sign-in handled by auth.ts; auth sign in route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:348
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-in" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-in", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

117. POST /auth/sign-out

• Purpose: POST /auth/sign-out handled by auth.ts; auth sign out route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:900
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-out" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-out", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

118. POST /auth/sign-up

• Purpose: POST /auth/sign-up handled by auth.ts; auth sign up route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1028
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-up" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-up", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

119. PUT /auth/social/profile

• Purpose: PUT /auth/social/profile handled by auth.ts; auth social profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1209
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/auth/social/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/social/profile", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

120. GET /auth/social/session

• Purpose: GET /auth/social/session handled by auth.ts; auth social session route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1149
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/auth/social/session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/social/session", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

121. POST /auth/social/sessions/revoke-others

• Purpose: POST /auth/social/sessions/revoke-others handled by auth.ts; auth social sessions revoke others route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:931
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/social/sessions/revoke-others" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/social/sessions/revoke-others", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

122. POST /auth/social/sign-up

• Purpose: POST /auth/social/sign-up handled by auth.ts; auth social sign up route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:1059
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/social/sign-up" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/social/sign-up", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

123. POST /hooks/send-email

• Purpose: POST /hooks/send-email handled by authEmail.ts; hooks send email route contract must be verified against source before integration.
• Source: partners-api/src/routes/authEmail.ts:868
• Mounted prefix: /hooks
• Route module: authEmail.ts
• Router variable: hooks
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/send-email" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/send-email", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

124. GET /api/lan-system/releases/assets/:assetId

• Purpose: GET /api/lan-system/releases/assets/:assetId handled by lanSystemReleases.ts; lan system releases assets assetId route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSystemReleases.ts:154
• Mounted prefix: /api
• Route module: lanSystemReleases.ts
• Router variable: api
• Stability: LAN support
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: assetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/lan-system/releases/assets/:assetId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/lan-system/releases/assets/:assetId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/ems-lan-support/

125. GET /api/lan-system/releases/latest

• Purpose: GET /api/lan-system/releases/latest handled by lanSystemReleases.ts; lan system releases latest route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSystemReleases.ts:99
• Mounted prefix: /api
• Route module: lanSystemReleases.ts
• Router variable: api
• Stability: LAN support
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/lan-system/releases/latest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/lan-system/releases/latest", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/ems-lan-support/

126. GET /api/events/:id/activities

• Purpose: GET /api/events/:id/activities handled by activities.ts; events id activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:622
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

127. PUT /api/events/:id/activities

• Purpose: PUT /api/events/:id/activities handled by activities.ts; events id activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:635
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

128. POST /api/events/:id/activities/submissions/:submissionId/review

• Purpose: POST /api/events/:id/activities/submissions/:submissionId/review handled by activities.ts; events id activities submissions submissionId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:709
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/activities/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

129. PUT /api/events/:id/addons

• Purpose: PUT /api/events/:id/addons handled by eventConfig.ts; events id addons route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:605
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/addons" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/addons", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

130. PUT /api/events/:id/check-in/:kind/:recordId

• Purpose: PUT /api/events/:id/check-in/:kind/:recordId handled by checkIn.ts; events id check in kind recordId route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2533
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

131. PUT /api/events/:id/check-in/:kind/:recordId/claim

• Purpose: PUT /api/events/:id/check-in/:kind/:recordId/claim handled by checkIn.ts; events id check in kind recordId claim route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2616
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId/claim", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

132. GET /api/events/:id/check-in/entries

• Purpose: GET /api/events/:id/check-in/entries handled by checkIn.ts; events id check in entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2227
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

133. GET /api/events/:id/check-in/entry

• Purpose: GET /api/events/:id/check-in/entry handled by checkIn.ts; events id check in entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2239
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

134. GET /api/events/:id/check-in/offline-snapshot

• Purpose: GET /api/events/:id/check-in/offline-snapshot handled by checkIn.ts; events id check in offline snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2375
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

135. GET /api/events/:id/check-in/offline-snapshot/history

• Purpose: GET /api/events/:id/check-in/offline-snapshot/history handled by checkIn.ts; events id check in offline snapshot history route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2362
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

136. POST /api/events/:id/check-in/offline-snapshot/import

• Purpose: POST /api/events/:id/check-in/offline-snapshot/import handled by checkIn.ts; events id check in offline snapshot import route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2496
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/import" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/import", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

137. POST /api/events/:id/check-in/pawsport-lookup

• Purpose: POST /api/events/:id/check-in/pawsport-lookup handled by checkIn.ts; events id check in pawsport lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2262
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/pawsport-lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/pawsport-lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

138. GET /api/events/:id/check-in/settings

• Purpose: GET /api/events/:id/check-in/settings handled by checkIn.ts; events id check in settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2189
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

139. PUT /api/events/:id/check-in/settings

• Purpose: PUT /api/events/:id/check-in/settings handled by checkIn.ts; events id check in settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2202
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

140. GET /api/events/:id/conditions-of-entry

• Purpose: GET /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

141. GET /api/events/:id/conditions-of-entry

• Purpose: GET /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

142. PUT /api/events/:id/conditions-of-entry

• Purpose: PUT /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

143. PUT /api/events/:id/conditions-of-entry

• Purpose: PUT /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

144. GET /api/events/:id/dealers-den/applications

• Purpose: GET /api/events/:id/dealers-den/applications handled by dealersDen.ts; events id dealers den applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1218
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

145. DELETE /api/events/:id/dealers-den/applications/:appId

• Purpose: DELETE /api/events/:id/dealers-den/applications/:appId handled by dealersDen.ts; events id dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1200
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

146. GET /api/events/:id/dealers-den/applications/:appId

• Purpose: GET /api/events/:id/dealers-den/applications/:appId handled by dealersDen.ts; events id dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1249
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

147. POST /api/events/:id/dealers-den/applications/:appId/approve

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/approve handled by dealersDen.ts; events id dealers den applications appId approve route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1278
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

148. POST /api/events/:id/dealers-den/applications/:appId/deny

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/deny handled by dealersDen.ts; events id dealers den applications appId deny route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1371
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/deny" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/deny", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

149. POST /api/events/:id/dealers-den/applications/:appId/request-changes

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/request-changes handled by dealersDen.ts; events id dealers den applications appId request changes route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1464
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/request-changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/request-changes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

150. GET /api/events/:id/dealers-den/packages

• Purpose: GET /api/events/:id/dealers-den/packages handled by dealersDen.ts; events id dealers den packages route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:809
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

151. POST /api/events/:id/dealers-den/packages

• Purpose: POST /api/events/:id/dealers-den/packages handled by dealersDen.ts; events id dealers den packages route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:825
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

152. DELETE /api/events/:id/dealers-den/packages/:pkgId

• Purpose: DELETE /api/events/:id/dealers-den/packages/:pkgId handled by dealersDen.ts; events id dealers den packages pkgId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:888
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

153. PUT /api/events/:id/dealers-den/packages/:pkgId

• Purpose: PUT /api/events/:id/dealers-den/packages/:pkgId handled by dealersDen.ts; events id dealers den packages pkgId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:867
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

154. PUT /api/events/:id/dealers-den/packages/order

• Purpose: PUT /api/events/:id/dealers-den/packages/order handled by dealersDen.ts; events id dealers den packages order route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:844
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

155. GET /api/events/:id/dealers-den/regos

• Purpose: GET /api/events/:id/dealers-den/regos handled by dealersDen.ts; events id dealers den regos route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:904
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

156. DELETE /api/events/:id/dealers-den/regos/:regoId

• Purpose: DELETE /api/events/:id/dealers-den/regos/:regoId handled by dealersDen.ts; events id dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:975
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

157. PATCH /api/events/:id/dealers-den/regos/:regoId

• Purpose: PATCH /api/events/:id/dealers-den/regos/:regoId handled by dealersDen.ts; events id dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1021
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

158. GET /api/events/:id/dealers-den/settings

• Purpose: GET /api/events/:id/dealers-den/settings handled by dealersDen.ts; events id dealers den settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:709
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

159. PUT /api/events/:id/dealers-den/settings

• Purpose: PUT /api/events/:id/dealers-den/settings handled by dealersDen.ts; events id dealers den settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:752
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

160. GET /api/events/:id/google-wallet-config

• Purpose: GET /api/events/:id/google-wallet-config handled by eventConfig.ts; events id google wallet config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:229
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

161. PUT /api/events/:id/google-wallet-config

• Purpose: PUT /api/events/:id/google-wallet-config handled by eventConfig.ts; events id google wallet config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:290
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

162. GET /api/events/:id/human-resources

• Purpose: GET /api/events/:id/human-resources handled by humanResources.ts; events id human resources route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1344
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

163. PUT /api/events/:id/human-resources

• Purpose: PUT /api/events/:id/human-resources handled by humanResources.ts; events id human resources route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1375
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

164. POST /api/events/:id/human-resources/applications/:applicationId/review

• Purpose: POST /api/events/:id/human-resources/applications/:applicationId/review handled by humanResources.ts; events id human resources applications applicationId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1676
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, applicationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/human-resources/applications/:applicationId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/applications/:applicationId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

165. GET /api/events/:id/human-resources/live-tracker

• Purpose: GET /api/events/:id/human-resources/live-tracker handled by humanResources.ts; events id human resources live tracker route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1635
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/live-tracker" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/live-tracker", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

166. GET /api/events/:id/human-resources/users/search

• Purpose: GET /api/events/:id/human-resources/users/search handled by humanResources.ts; events id human resources users search route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1359
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

167. PUT /api/events/:id/inclusions

• Purpose: PUT /api/events/:id/inclusions handled by eventConfig.ts; events id inclusions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:379
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inclusions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inclusions", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

168. GET /api/events/:id/inventory

• Purpose: GET /api/events/:id/inventory handled by inventory.ts; events id inventory route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1366
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

169. GET /api/events/:id/inventory/movements

• Purpose: GET /api/events/:id/inventory/movements handled by inventory.ts; events id inventory movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1497
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

170. PUT /api/events/:id/inventory/on-hand

• Purpose: PUT /api/events/:id/inventory/on-hand handled by inventory.ts; events id inventory on hand route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1413
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/on-hand" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/on-hand", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

171. POST /api/events/:id/inventory/pos/quote

• Purpose: POST /api/events/:id/inventory/pos/quote handled by inventory.ts; events id inventory pos quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1561
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

172. GET /api/events/:id/inventory/pos/transactions

• Purpose: GET /api/events/:id/inventory/pos/transactions handled by inventory.ts; events id inventory pos transactions route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1541
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

173. POST /api/events/:id/inventory/pos/transactions

• Purpose: POST /api/events/:id/inventory/pos/transactions handled by inventory.ts; events id inventory pos transactions route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1616
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

174. PUT /api/events/:id/inventory/settings

• Purpose: PUT /api/events/:id/inventory/settings handled by inventory.ts; events id inventory settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1380
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

175. POST /api/events/:id/notifications/sample

• Purpose: POST /api/events/:id/notifications/sample handled by eventConfig.ts; events id notifications sample route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:54
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/notifications/sample" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/notifications/sample", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

176. GET /api/events/:id/prefills

• Purpose: GET /api/events/:id/prefills handled by eventConfig.ts; events id prefills route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:77
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

177. POST /api/events/:id/prefills/:prefillId/revoke

• Purpose: POST /api/events/:id/prefills/:prefillId/revoke handled by eventConfig.ts; events id prefills prefillId revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:115
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, prefillId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/prefills/:prefillId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills/:prefillId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

178. PUT /api/events/:id/public-visibility

• Purpose: PUT /api/events/:id/public-visibility handled by eventConfig.ts; events id public visibility route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:142
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/public-visibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/public-visibility", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

179. GET /api/events/:id/rego/analytics

• Purpose: GET /api/events/:id/rego/analytics handled by regoAnalytics.ts; events id rego analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAnalytics.ts:159
• Mounted prefix: /api
• Route module: regoAnalytics.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

180. PUT /api/events/:id/tiers

• Purpose: PUT /api/events/:id/tiers handled by eventConfig.ts; events id tiers route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:460
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/tiers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/tiers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

181. GET /api/manage/:id/activities

• Purpose: GET /api/manage/:id/activities is the Event Management compatibility alias for /api/events/:id/activities.
• Source: partners-api/src/routes/activities.ts:622
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

182. PUT /api/manage/:id/activities

• Purpose: PUT /api/manage/:id/activities is the Event Management compatibility alias for /api/events/:id/activities.
• Source: partners-api/src/routes/activities.ts:635
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

183. POST /api/manage/:id/activities/submissions/:submissionId/review

• Purpose: POST /api/manage/:id/activities/submissions/:submissionId/review is the Event Management compatibility alias for /api/events/:id/activities/submissions/:submissionId/review.
• Source: partners-api/src/routes/activities.ts:709
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/activities/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

184. PUT /api/manage/:id/addons

• Purpose: PUT /api/manage/:id/addons is the Event Management compatibility alias for /api/events/:id/addons.
• Source: partners-api/src/routes/eventConfig.ts:605
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/addons" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/addons", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

185. PUT /api/manage/:id/check-in/:kind/:recordId

• Purpose: PUT /api/manage/:id/check-in/:kind/:recordId is the Event Management compatibility alias for /api/events/:id/check-in/:kind/:recordId.
• Source: partners-api/src/routes/checkIn.ts:2533
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

186. PUT /api/manage/:id/check-in/:kind/:recordId/claim

• Purpose: PUT /api/manage/:id/check-in/:kind/:recordId/claim is the Event Management compatibility alias for /api/events/:id/check-in/:kind/:recordId/claim.
• Source: partners-api/src/routes/checkIn.ts:2616
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId/claim", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

187. GET /api/manage/:id/check-in/entries

• Purpose: GET /api/manage/:id/check-in/entries is the Event Management compatibility alias for /api/events/:id/check-in/entries.
• Source: partners-api/src/routes/checkIn.ts:2227
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

188. GET /api/manage/:id/check-in/entry

• Purpose: GET /api/manage/:id/check-in/entry is the Event Management compatibility alias for /api/events/:id/check-in/entry.
• Source: partners-api/src/routes/checkIn.ts:2239
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

189. GET /api/manage/:id/check-in/offline-snapshot

• Purpose: GET /api/manage/:id/check-in/offline-snapshot is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot.
• Source: partners-api/src/routes/checkIn.ts:2375
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

190. GET /api/manage/:id/check-in/offline-snapshot/history

• Purpose: GET /api/manage/:id/check-in/offline-snapshot/history is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot/history.
• Source: partners-api/src/routes/checkIn.ts:2362
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

191. POST /api/manage/:id/check-in/offline-snapshot/import

• Purpose: POST /api/manage/:id/check-in/offline-snapshot/import is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot/import.
• Source: partners-api/src/routes/checkIn.ts:2496
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/import" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/import", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

192. POST /api/manage/:id/check-in/pawsport-lookup

• Purpose: POST /api/manage/:id/check-in/pawsport-lookup is the Event Management compatibility alias for /api/events/:id/check-in/pawsport-lookup.
• Source: partners-api/src/routes/checkIn.ts:2262
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/pawsport-lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/pawsport-lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

193. GET /api/manage/:id/check-in/settings

• Purpose: GET /api/manage/:id/check-in/settings is the Event Management compatibility alias for /api/events/:id/check-in/settings.
• Source: partners-api/src/routes/checkIn.ts:2189
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

194. PUT /api/manage/:id/check-in/settings

• Purpose: PUT /api/manage/:id/check-in/settings is the Event Management compatibility alias for /api/events/:id/check-in/settings.
• Source: partners-api/src/routes/checkIn.ts:2202
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

195. GET /api/manage/:id/conditions-of-entry

• Purpose: GET /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

196. GET /api/manage/:id/conditions-of-entry

• Purpose: GET /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

197. PUT /api/manage/:id/conditions-of-entry

• Purpose: PUT /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

198. PUT /api/manage/:id/conditions-of-entry

• Purpose: PUT /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

199. GET /api/manage/:id/dealers-den/applications

• Purpose: GET /api/manage/:id/dealers-den/applications is the Event Management compatibility alias for /api/events/:id/dealers-den/applications.
• Source: partners-api/src/routes/dealersDen.ts:1218
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

200. DELETE /api/manage/:id/dealers-den/applications/:appId

• Purpose: DELETE /api/manage/:id/dealers-den/applications/:appId is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId.
• Source: partners-api/src/routes/dealersDen.ts:1200
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

201. GET /api/manage/:id/dealers-den/applications/:appId

• Purpose: GET /api/manage/:id/dealers-den/applications/:appId is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId.
• Source: partners-api/src/routes/dealersDen.ts:1249
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

202. POST /api/manage/:id/dealers-den/applications/:appId/approve

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/approve is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/approve.
• Source: partners-api/src/routes/dealersDen.ts:1278
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

203. POST /api/manage/:id/dealers-den/applications/:appId/deny

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/deny is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/deny.
• Source: partners-api/src/routes/dealersDen.ts:1371
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/deny" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/deny", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

204. POST /api/manage/:id/dealers-den/applications/:appId/request-changes

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/request-changes is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/request-changes.
• Source: partners-api/src/routes/dealersDen.ts:1464
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/request-changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/request-changes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

205. GET /api/manage/:id/dealers-den/packages

• Purpose: GET /api/manage/:id/dealers-den/packages is the Event Management compatibility alias for /api/events/:id/dealers-den/packages.
• Source: partners-api/src/routes/dealersDen.ts:809
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

206. POST /api/manage/:id/dealers-den/packages

• Purpose: POST /api/manage/:id/dealers-den/packages is the Event Management compatibility alias for /api/events/:id/dealers-den/packages.
• Source: partners-api/src/routes/dealersDen.ts:825
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

207. DELETE /api/manage/:id/dealers-den/packages/:pkgId

• Purpose: DELETE /api/manage/:id/dealers-den/packages/:pkgId is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/:pkgId.
• Source: partners-api/src/routes/dealersDen.ts:888
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

208. PUT /api/manage/:id/dealers-den/packages/:pkgId

• Purpose: PUT /api/manage/:id/dealers-den/packages/:pkgId is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/:pkgId.
• Source: partners-api/src/routes/dealersDen.ts:867
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

209. PUT /api/manage/:id/dealers-den/packages/order

• Purpose: PUT /api/manage/:id/dealers-den/packages/order is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/order.
• Source: partners-api/src/routes/dealersDen.ts:844
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

210. GET /api/manage/:id/dealers-den/regos

• Purpose: GET /api/manage/:id/dealers-den/regos is the Event Management compatibility alias for /api/events/:id/dealers-den/regos.
• Source: partners-api/src/routes/dealersDen.ts:904
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

211. DELETE /api/manage/:id/dealers-den/regos/:regoId

• Purpose: DELETE /api/manage/:id/dealers-den/regos/:regoId is the Event Management compatibility alias for /api/events/:id/dealers-den/regos/:regoId.
• Source: partners-api/src/routes/dealersDen.ts:975
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

212. PATCH /api/manage/:id/dealers-den/regos/:regoId

• Purpose: PATCH /api/manage/:id/dealers-den/regos/:regoId is the Event Management compatibility alias for /api/events/:id/dealers-den/regos/:regoId.
• Source: partners-api/src/routes/dealersDen.ts:1021
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

213. GET /api/manage/:id/dealers-den/settings

• Purpose: GET /api/manage/:id/dealers-den/settings is the Event Management compatibility alias for /api/events/:id/dealers-den/settings.
• Source: partners-api/src/routes/dealersDen.ts:709
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

214. PUT /api/manage/:id/dealers-den/settings

• Purpose: PUT /api/manage/:id/dealers-den/settings is the Event Management compatibility alias for /api/events/:id/dealers-den/settings.
• Source: partners-api/src/routes/dealersDen.ts:752
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

215. GET /api/manage/:id/google-wallet-config

• Purpose: GET /api/manage/:id/google-wallet-config is the Event Management compatibility alias for /api/events/:id/google-wallet-config.
• Source: partners-api/src/routes/eventConfig.ts:229
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

216. PUT /api/manage/:id/google-wallet-config

• Purpose: PUT /api/manage/:id/google-wallet-config is the Event Management compatibility alias for /api/events/:id/google-wallet-config.
• Source: partners-api/src/routes/eventConfig.ts:290
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

217. GET /api/manage/:id/human-resources

• Purpose: GET /api/manage/:id/human-resources is the Event Management compatibility alias for /api/events/:id/human-resources.
• Source: partners-api/src/routes/humanResources.ts:1344
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

218. PUT /api/manage/:id/human-resources

• Purpose: PUT /api/manage/:id/human-resources is the Event Management compatibility alias for /api/events/:id/human-resources.
• Source: partners-api/src/routes/humanResources.ts:1375
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

219. POST /api/manage/:id/human-resources/applications/:applicationId/review

• Purpose: POST /api/manage/:id/human-resources/applications/:applicationId/review is the Event Management compatibility alias for /api/events/:id/human-resources/applications/:applicationId/review.
• Source: partners-api/src/routes/humanResources.ts:1676
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, applicationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/human-resources/applications/:applicationId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/applications/:applicationId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

220. GET /api/manage/:id/human-resources/live-tracker

• Purpose: GET /api/manage/:id/human-resources/live-tracker is the Event Management compatibility alias for /api/events/:id/human-resources/live-tracker.
• Source: partners-api/src/routes/humanResources.ts:1635
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/live-tracker" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/live-tracker", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

221. GET /api/manage/:id/human-resources/users/search

• Purpose: GET /api/manage/:id/human-resources/users/search is the Event Management compatibility alias for /api/events/:id/human-resources/users/search.
• Source: partners-api/src/routes/humanResources.ts:1359
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

222. PUT /api/manage/:id/inclusions

• Purpose: PUT /api/manage/:id/inclusions is the Event Management compatibility alias for /api/events/:id/inclusions.
• Source: partners-api/src/routes/eventConfig.ts:379
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inclusions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inclusions", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

223. GET /api/manage/:id/inventory

• Purpose: GET /api/manage/:id/inventory is the Event Management compatibility alias for /api/events/:id/inventory.
• Source: partners-api/src/routes/inventory.ts:1366
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

224. GET /api/manage/:id/inventory/movements

• Purpose: GET /api/manage/:id/inventory/movements is the Event Management compatibility alias for /api/events/:id/inventory/movements.
• Source: partners-api/src/routes/inventory.ts:1497
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

225. PUT /api/manage/:id/inventory/on-hand

• Purpose: PUT /api/manage/:id/inventory/on-hand is the Event Management compatibility alias for /api/events/:id/inventory/on-hand.
• Source: partners-api/src/routes/inventory.ts:1413
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/on-hand" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/on-hand", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

226. POST /api/manage/:id/inventory/pos/quote

• Purpose: POST /api/manage/:id/inventory/pos/quote is the Event Management compatibility alias for /api/events/:id/inventory/pos/quote.
• Source: partners-api/src/routes/inventory.ts:1561
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

227. GET /api/manage/:id/inventory/pos/transactions

• Purpose: GET /api/manage/:id/inventory/pos/transactions is the Event Management compatibility alias for /api/events/:id/inventory/pos/transactions.
• Source: partners-api/src/routes/inventory.ts:1541
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

228. POST /api/manage/:id/inventory/pos/transactions

• Purpose: POST /api/manage/:id/inventory/pos/transactions is the Event Management compatibility alias for /api/events/:id/inventory/pos/transactions.
• Source: partners-api/src/routes/inventory.ts:1616
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

229. PUT /api/manage/:id/inventory/settings

• Purpose: PUT /api/manage/:id/inventory/settings is the Event Management compatibility alias for /api/events/:id/inventory/settings.
• Source: partners-api/src/routes/inventory.ts:1380
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

230. POST /api/manage/:id/notifications/sample

• Purpose: POST /api/manage/:id/notifications/sample is the Event Management compatibility alias for /api/events/:id/notifications/sample.
• Source: partners-api/src/routes/eventConfig.ts:54
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/notifications/sample" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/notifications/sample", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

231. GET /api/manage/:id/prefills

• Purpose: GET /api/manage/:id/prefills is the Event Management compatibility alias for /api/events/:id/prefills.
• Source: partners-api/src/routes/eventConfig.ts:77
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

232. POST /api/manage/:id/prefills/:prefillId/revoke

• Purpose: POST /api/manage/:id/prefills/:prefillId/revoke is the Event Management compatibility alias for /api/events/:id/prefills/:prefillId/revoke.
• Source: partners-api/src/routes/eventConfig.ts:115
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, prefillId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/prefills/:prefillId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills/:prefillId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

233. PUT /api/manage/:id/public-visibility

• Purpose: PUT /api/manage/:id/public-visibility is the Event Management compatibility alias for /api/events/:id/public-visibility.
• Source: partners-api/src/routes/eventConfig.ts:142
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/public-visibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/public-visibility", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

234. GET /api/manage/:id/rego/analytics

• Purpose: GET /api/manage/:id/rego/analytics is the Event Management compatibility alias for /api/events/:id/rego/analytics.
• Source: partners-api/src/routes/regoAnalytics.ts:159
• Mounted prefix: /api
• Route module: regoAnalytics.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

235. PUT /api/manage/:id/tiers

• Purpose: PUT /api/manage/:id/tiers is the Event Management compatibility alias for /api/events/:id/tiers.
• Source: partners-api/src/routes/eventConfig.ts:460
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/tiers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/tiers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

236. GET /api/rego/activities/submissions/my

• Purpose: GET /api/rego/activities/submissions/my handled by activities.ts; rego activities submissions my route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:941
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/activities/submissions/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/activities/submissions/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

237. GET /api/rego/dealers-den/:eventId/info

• Purpose: GET /api/rego/dealers-den/:eventId/info handled by dealersDen.ts; rego dealers den eventId info route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1562
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/:eventId/info" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/:eventId/info", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

238. POST /api/rego/dealers-den/applications

• Purpose: POST /api/rego/dealers-den/applications handled by dealersDen.ts; rego dealers den applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1805
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

239. DELETE /api/rego/dealers-den/applications/:appId

• Purpose: DELETE /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2017
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

240. GET /api/rego/dealers-den/applications/:appId

• Purpose: GET /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1755
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

241. PATCH /api/rego/dealers-den/applications/:appId

• Purpose: PATCH /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1939
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

242. POST /api/rego/dealers-den/applications/:appId/assistants

• Purpose: POST /api/rego/dealers-den/applications/:appId/assistants handled by dealersDen.ts; rego dealers den applications appId assistants route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2055
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/applications/:appId/assistants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId/assistants", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

243. DELETE /api/rego/dealers-den/applications/:appId/assistants/:aid

• Purpose: DELETE /api/rego/dealers-den/applications/:appId/assistants/:aid handled by dealersDen.ts; rego dealers den applications appId assistants aid route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2136
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId, aid
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/dealers-den/applications/:appId/assistants/:aid" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId/assistants/:aid", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

244. GET /api/rego/dealers-den/applications/my

• Purpose: GET /api/rego/dealers-den/applications/my handled by dealersDen.ts; rego dealers den applications my route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1667
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/applications/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

245. PATCH /api/rego/dealers-den/assistants/:aid/respond

• Purpose: PATCH /api/rego/dealers-den/assistants/:aid/respond handled by dealersDen.ts; rego dealers den assistants aid respond route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2173
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: aid
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/dealers-den/assistants/:aid/respond" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/assistants/:aid/respond", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

246. POST /api/rego/dealers-den/events/:eventId/reserve

• Purpose: POST /api/rego/dealers-den/events/:eventId/reserve handled by dealersDen.ts; rego dealers den events eventId reserve route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2217
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/events/:eventId/reserve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/events/:eventId/reserve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

247. GET /api/rego/dealers-den/regos/:regoId

• Purpose: GET /api/rego/dealers-den/regos/:regoId handled by dealersDen.ts; rego dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2763
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/:regoId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

248. GET /api/rego/dealers-den/regos/:regoId/wallet

• Purpose: GET /api/rego/dealers-den/regos/:regoId/wallet handled by dealersDen.ts; rego dealers den regos regoId wallet route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2893
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/:regoId/wallet" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/:regoId/wallet", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

249. GET /api/rego/dealers-den/regos/my

• Purpose: GET /api/rego/dealers-den/regos/my handled by dealersDen.ts; rego dealers den regos my route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1687
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

250. POST /api/rego/dealers-den/regos/submit

• Purpose: POST /api/rego/dealers-den/regos/submit handled by dealersDen.ts; rego dealers den regos submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2351
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/regos/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

251. POST /api/rego/dealers-den/reservations/:id/release

• Purpose: POST /api/rego/dealers-den/reservations/:id/release handled by dealersDen.ts; rego dealers den reservations id release route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2317
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/reservations/:id/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/reservations/:id/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

252. GET /api/rego/events/:slug/activities

• Purpose: GET /api/rego/events/:slug/activities handled by activities.ts; rego events slug activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:800
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

253. GET /api/rego/events/:slug/activities/:activitySlug

• Purpose: GET /api/rego/events/:slug/activities/:activitySlug handled by activities.ts; rego events slug activities activitySlug route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:1044
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, activitySlug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities/:activitySlug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/:activitySlug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

254. POST /api/rego/events/:slug/activities/:activitySlug/submissions

• Purpose: POST /api/rego/events/:slug/activities/:activitySlug/submissions handled by activities.ts; rego events slug activities activitySlug submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:1099
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, activitySlug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/activities/:activitySlug/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/:activitySlug/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

255. GET /api/rego/events/:slug/activities/submissions/my

• Purpose: GET /api/rego/events/:slug/activities/submissions/my handled by activities.ts; rego events slug activities submissions my route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:853
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities/submissions/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/submissions/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

256. GET /api/rego/events/:slug/shift-authorizers

• Purpose: GET /api/rego/events/:slug/shift-authorizers handled by humanResources.ts; rego events slug shift authorizers route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:2181
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/shift-authorizers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/shift-authorizers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

257. POST /api/rego/events/:slug/volunteer-applications

• Purpose: POST /api/rego/events/:slug/volunteer-applications handled by humanResources.ts; rego events slug volunteer applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1860
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/volunteer-applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/volunteer-applications", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

258. GET /api/rego/events/:slug/volunteer-opportunities

• Purpose: GET /api/rego/events/:slug/volunteer-opportunities handled by humanResources.ts; rego events slug volunteer opportunities route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1764
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/volunteer-opportunities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/volunteer-opportunities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

259. GET /api/rego/human-resources/me

• Purpose: GET /api/rego/human-resources/me handled by humanResources.ts; rego human resources me route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1998
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/human-resources/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/human-resources/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

260. POST /api/rego/human-resources/shifts/:shiftId/track

• Purpose: POST /api/rego/human-resources/shifts/:shiftId/track handled by humanResources.ts; rego human resources shifts shiftId track route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:2225
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: shiftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/human-resources/shifts/:shiftId/track" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/human-resources/shifts/:shiftId/track", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

261. POST /api/rego/notices/:id/ack

• Purpose: POST /api/rego/notices/:id/ack handled by regoNotices.ts; rego notices id ack route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:145
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notices/:id/ack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notices/:id/ack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

262. GET /api/rego/notices/unacked

• Purpose: GET /api/rego/notices/unacked handled by regoNotices.ts; rego notices unacked route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:60
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notices/unacked" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notices/unacked", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

263. GET /api/rego/notifications

• Purpose: GET /api/rego/notifications handled by regoNotices.ts; rego notifications route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:192
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notifications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

264. POST /api/rego/notifications/:id/read

• Purpose: POST /api/rego/notifications/:id/read handled by regoNotices.ts; rego notifications id read route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:279
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notifications/:id/read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/:id/read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

265. POST /api/rego/notifications/mark-all-read

• Purpose: POST /api/rego/notifications/mark-all-read handled by regoNotices.ts; rego notifications mark all read route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:307
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notifications/mark-all-read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/mark-all-read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

266. GET /api/rego/notifications/unread-count

• Purpose: GET /api/rego/notifications/unread-count handled by regoNotices.ts; rego notifications unread count route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:255
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notifications/unread-count" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/unread-count", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

267. GET /api/rego/transactions/me

• Purpose: GET /api/rego/transactions/me handled by inventory.ts; rego transactions me route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1724
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: regoApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/transactions/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/transactions/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

268. POST /api/events/:eventId/payment-accounts/:accountId/report

• Purpose: POST /api/events/:eventId/payment-accounts/:accountId/report handled by paymentAccountReports.ts; events eventId payment accounts accountId report route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccountReports.ts:18
• Mounted prefix: /api
• Route module: paymentAccountReports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/payment-accounts/:accountId/report" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/payment-accounts/:accountId/report", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

269. GET /api/events/:id/finance-programs

• Purpose: GET /api/events/:id/finance-programs handled by financePrograms.ts; events id finance programs route contract must be verified against source before integration.
• Source: partners-api/src/routes/financePrograms.ts:536
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

270. PUT /api/events/:id/finance-programs

• Purpose: PUT /api/events/:id/finance-programs handled by financePrograms.ts; events id finance programs route contract must be verified against source before integration.
• Source: partners-api/src/routes/financePrograms.ts:551
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

271. GET /api/events/:id/finance/accounting

• Purpose: GET /api/events/:id/finance/accounting handled by finance.ts; events id finance accounting route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1022
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/accounting" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

272. POST /api/events/:id/finance/accounting/deductions

• Purpose: POST /api/events/:id/finance/accounting/deductions handled by finance.ts; events id finance accounting deductions route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1190
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/deductions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/deductions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

273. POST /api/events/:id/finance/accounting/entries

• Purpose: POST /api/events/:id/finance/accounting/entries handled by finance.ts; events id finance accounting entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1177
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

274. PATCH /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId

• Purpose: PATCH /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId handled by finance.ts; events id finance accounting ledger sourceType sourceId route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1203
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, sourceType, sourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

275. GET /api/events/:id/finance/analytics

• Purpose: GET /api/events/:id/finance/analytics handled by finance.ts; events id finance analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:998
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

276. GET /api/events/:id/finance/settlements

• Purpose: GET /api/events/:id/finance/settlements handled by finance.ts; events id finance settlements route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1293
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

277. POST /api/events/:id/finance/settlements

• Purpose: POST /api/events/:id/finance/settlements handled by finance.ts; events id finance settlements route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1356
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

278. POST /api/events/:id/finance/settlements/quote

• Purpose: POST /api/events/:id/finance/settlements/quote handled by finance.ts; events id finance settlements quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1319
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

279. GET /api/events/:id/payment-account-reports

• Purpose: GET /api/events/:id/payment-account-reports handled by paymentAccounts.ts; events id payment account reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:202
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-account-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-account-reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

280. GET /api/events/:id/payment-accounts

• Purpose: GET /api/events/:id/payment-accounts handled by paymentAccounts.ts; events id payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:93
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

281. PUT /api/events/:id/payment-accounts

• Purpose: PUT /api/events/:id/payment-accounts handled by paymentAccounts.ts; events id payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:117
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

282. GET /api/events/:id/payment-providers

• Purpose: GET /api/events/:id/payment-providers handled by paymentProviders.ts; events id payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentProviders.ts:125
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

283. PUT /api/events/:id/payment-providers

• Purpose: PUT /api/events/:id/payment-providers handled by paymentProviders.ts; events id payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentProviders.ts:182
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

284. GET /api/events/:id/rego-refunds

• Purpose: GET /api/events/:id/rego-refunds handled by regoRefunds.ts; events id rego refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:959
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

285. PATCH /api/events/:id/rego-refunds/:refundId/review

• Purpose: PATCH /api/events/:id/rego-refunds/:refundId/review handled by regoRefunds.ts; events id rego refunds refundId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:981
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, refundId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-refunds/:refundId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds/:refundId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

286. GET /api/events/:id/rego-transfers

• Purpose: GET /api/events/:id/rego-transfers handled by regoTransfers.ts; events id rego transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:928
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

287. PATCH /api/events/:id/rego-transfers/:transferId/review

• Purpose: PATCH /api/events/:id/rego-transfers/:transferId/review handled by regoTransfers.ts; events id rego transfers transferId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:950
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, transferId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-transfers/:transferId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers/:transferId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

288. GET /api/events/:id/rego-upgrades

• Purpose: GET /api/events/:id/rego-upgrades handled by regoUpgrades.ts; events id rego upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1330
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

289. PATCH /api/events/:id/rego-upgrades/:upgradeId/review

• Purpose: PATCH /api/events/:id/rego-upgrades/:upgradeId/review handled by regoUpgrades.ts; events id rego upgrades upgradeId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1394
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, upgradeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-upgrades/:upgradeId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades/:upgradeId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

290. POST /api/manage/:eventId/payment-accounts/:accountId/report

• Purpose: POST /api/manage/:eventId/payment-accounts/:accountId/report is the Event Management compatibility alias for /api/events/:eventId/payment-accounts/:accountId/report.
• Source: partners-api/src/routes/paymentAccountReports.ts:18
• Mounted prefix: /api
• Route module: paymentAccountReports.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/payment-accounts/:accountId/report" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/payment-accounts/:accountId/report", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

291. GET /api/manage/:id/finance-programs

• Purpose: GET /api/manage/:id/finance-programs is the Event Management compatibility alias for /api/events/:id/finance-programs.
• Source: partners-api/src/routes/financePrograms.ts:536
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

292. PUT /api/manage/:id/finance-programs

• Purpose: PUT /api/manage/:id/finance-programs is the Event Management compatibility alias for /api/events/:id/finance-programs.
• Source: partners-api/src/routes/financePrograms.ts:551
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

293. GET /api/manage/:id/finance/accounting

• Purpose: GET /api/manage/:id/finance/accounting is the Event Management compatibility alias for /api/events/:id/finance/accounting.
• Source: partners-api/src/routes/finance.ts:1022
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/accounting" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

294. POST /api/manage/:id/finance/accounting/deductions

• Purpose: POST /api/manage/:id/finance/accounting/deductions is the Event Management compatibility alias for /api/events/:id/finance/accounting/deductions.
• Source: partners-api/src/routes/finance.ts:1190
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/deductions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/deductions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

295. POST /api/manage/:id/finance/accounting/entries

• Purpose: POST /api/manage/:id/finance/accounting/entries is the Event Management compatibility alias for /api/events/:id/finance/accounting/entries.
• Source: partners-api/src/routes/finance.ts:1177
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

296. PATCH /api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId

• Purpose: PATCH /api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId is the Event Management compatibility alias for /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId.
• Source: partners-api/src/routes/finance.ts:1203
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, sourceType, sourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

297. GET /api/manage/:id/finance/analytics

• Purpose: GET /api/manage/:id/finance/analytics is the Event Management compatibility alias for /api/events/:id/finance/analytics.
• Source: partners-api/src/routes/finance.ts:998
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

298. GET /api/manage/:id/finance/settlements

• Purpose: GET /api/manage/:id/finance/settlements is the Event Management compatibility alias for /api/events/:id/finance/settlements.
• Source: partners-api/src/routes/finance.ts:1293
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

299. POST /api/manage/:id/finance/settlements

• Purpose: POST /api/manage/:id/finance/settlements is the Event Management compatibility alias for /api/events/:id/finance/settlements.
• Source: partners-api/src/routes/finance.ts:1356
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

300. POST /api/manage/:id/finance/settlements/quote

• Purpose: POST /api/manage/:id/finance/settlements/quote is the Event Management compatibility alias for /api/events/:id/finance/settlements/quote.
• Source: partners-api/src/routes/finance.ts:1319
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

301. GET /api/manage/:id/payment-account-reports

• Purpose: GET /api/manage/:id/payment-account-reports is the Event Management compatibility alias for /api/events/:id/payment-account-reports.
• Source: partners-api/src/routes/paymentAccounts.ts:202
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-account-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-account-reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

302. GET /api/manage/:id/payment-accounts

• Purpose: GET /api/manage/:id/payment-accounts is the Event Management compatibility alias for /api/events/:id/payment-accounts.
• Source: partners-api/src/routes/paymentAccounts.ts:93
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

303. PUT /api/manage/:id/payment-accounts

• Purpose: PUT /api/manage/:id/payment-accounts is the Event Management compatibility alias for /api/events/:id/payment-accounts.
• Source: partners-api/src/routes/paymentAccounts.ts:117
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

304. GET /api/manage/:id/payment-providers

• Purpose: GET /api/manage/:id/payment-providers is the Event Management compatibility alias for /api/events/:id/payment-providers.
• Source: partners-api/src/routes/paymentProviders.ts:125
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

305. PUT /api/manage/:id/payment-providers

• Purpose: PUT /api/manage/:id/payment-providers is the Event Management compatibility alias for /api/events/:id/payment-providers.
• Source: partners-api/src/routes/paymentProviders.ts:182
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

306. GET /api/manage/:id/rego-refunds

• Purpose: GET /api/manage/:id/rego-refunds is the Event Management compatibility alias for /api/events/:id/rego-refunds.
• Source: partners-api/src/routes/regoRefunds.ts:959
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

307. PATCH /api/manage/:id/rego-refunds/:refundId/review

• Purpose: PATCH /api/manage/:id/rego-refunds/:refundId/review is the Event Management compatibility alias for /api/events/:id/rego-refunds/:refundId/review.
• Source: partners-api/src/routes/regoRefunds.ts:981
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, refundId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-refunds/:refundId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds/:refundId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

308. GET /api/manage/:id/rego-transfers

• Purpose: GET /api/manage/:id/rego-transfers is the Event Management compatibility alias for /api/events/:id/rego-transfers.
• Source: partners-api/src/routes/regoTransfers.ts:928
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

309. PATCH /api/manage/:id/rego-transfers/:transferId/review

• Purpose: PATCH /api/manage/:id/rego-transfers/:transferId/review is the Event Management compatibility alias for /api/events/:id/rego-transfers/:transferId/review.
• Source: partners-api/src/routes/regoTransfers.ts:950
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, transferId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-transfers/:transferId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers/:transferId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

310. GET /api/manage/:id/rego-upgrades

• Purpose: GET /api/manage/:id/rego-upgrades is the Event Management compatibility alias for /api/events/:id/rego-upgrades.
• Source: partners-api/src/routes/regoUpgrades.ts:1330
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

311. PATCH /api/manage/:id/rego-upgrades/:upgradeId/review

• Purpose: PATCH /api/manage/:id/rego-upgrades/:upgradeId/review is the Event Management compatibility alias for /api/events/:id/rego-upgrades/:upgradeId/review.
• Source: partners-api/src/routes/regoUpgrades.ts:1394
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, upgradeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-upgrades/:upgradeId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades/:upgradeId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

312. POST /api/rego/rego-upgrades/:id/pay

• Purpose: POST /api/rego/rego-upgrades/:id/pay handled by regoUpgrades.ts; rego rego upgrades id pay route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1197
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/rego-upgrades/:id/pay" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/rego-upgrades/:id/pay", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

313. GET /api/rego/regos/:ref/refunds

• Purpose: GET /api/rego/regos/:ref/refunds handled by regoRefunds.ts; rego regos ref refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:744
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

314. POST /api/rego/regos/:ref/refunds

• Purpose: POST /api/rego/regos/:ref/refunds handled by regoRefunds.ts; rego regos ref refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:799
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/refunds", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

315. GET /api/rego/regos/:ref/transfers

• Purpose: GET /api/rego/regos/:ref/transfers handled by regoTransfers.ts; rego regos ref transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:630
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

316. POST /api/rego/regos/:ref/transfers

• Purpose: POST /api/rego/regos/:ref/transfers handled by regoTransfers.ts; rego regos ref transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:692
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/transfers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

317. GET /api/rego/regos/:ref/upgrades

• Purpose: GET /api/rego/regos/:ref/upgrades handled by regoUpgrades.ts; rego regos ref upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:943
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

318. POST /api/rego/regos/:ref/upgrades

• Purpose: POST /api/rego/regos/:ref/upgrades handled by regoUpgrades.ts; rego regos ref upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1032
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/upgrades", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

319. GET /api/rego/users/transfer-search

• Purpose: GET /api/rego/users/transfer-search handled by regoTransfers.ts; rego users transfer search route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:599
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/users/transfer-search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/users/transfer-search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

320. GET /api/admin/platform-waitlist

• Purpose: GET /api/admin/platform-waitlist handled by platformWaitlist.ts; admin platform waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/platformWaitlist.ts:205
• Mounted prefix: /api
• Route module: platformWaitlist.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-waitlist", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

321. GET /api/admin/platform-waitlist

• Purpose: GET /api/admin/platform-waitlist handled by platformWaitlist.ts; admin platform waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/platformWaitlist.ts:205
• Mounted prefix: /api
• Route module: platformWaitlist.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-waitlist", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

322. GET /api/admin/social-advertising/campaigns

• Purpose: GET /api/admin/social-advertising/campaigns handled by socialAdvertisingAdmin.ts; admin social advertising campaigns route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:91
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/social-advertising/campaigns" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/campaigns", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

323. POST /api/admin/social-advertising/campaigns

• Purpose: POST /api/admin/social-advertising/campaigns handled by socialAdvertisingAdmin.ts; admin social advertising campaigns route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:105
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/social-advertising/campaigns" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/campaigns", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

324. GET /api/admin/social-advertising/campaigns/:campaignId/daily-metrics

• Purpose: GET /api/admin/social-advertising/campaigns/:campaignId/daily-metrics handled by socialAdvertisingAdmin.ts; admin social advertising campaigns campaignId daily metrics route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:170
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: campaignId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/social-advertising/campaigns/:campaignId/daily-metrics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/campaigns/:campaignId/daily-metrics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

325. GET /api/admin/social-advertising/campaigns/:campaignId/history

• Purpose: GET /api/admin/social-advertising/campaigns/:campaignId/history handled by socialAdvertisingAdmin.ts; admin social advertising campaigns campaignId history route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:157
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: campaignId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/social-advertising/campaigns/:campaignId/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/campaigns/:campaignId/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

326. POST /api/admin/social-advertising/campaigns/:campaignId/transition

• Purpose: POST /api/admin/social-advertising/campaigns/:campaignId/transition handled by socialAdvertisingAdmin.ts; admin social advertising campaigns campaignId transition route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:127
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: campaignId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/social-advertising/campaigns/:campaignId/transition" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/campaigns/:campaignId/transition", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

327. GET /api/admin/social-advertising/providers

• Purpose: GET /api/admin/social-advertising/providers handled by socialAdvertisingAdmin.ts; admin social advertising providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:147
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/social-advertising/providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/providers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

328. POST /api/admin/social-advertising/providers/adsense

• Purpose: POST /api/admin/social-advertising/providers/adsense handled by socialAdvertisingAdmin.ts; admin social advertising providers adsense route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialAdvertisingAdmin.ts:189
• Mounted prefix: /api
• Route module: socialAdvertisingAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/social-advertising/providers/adsense" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-advertising/providers/adsense", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

329. GET /api/admin/social-location/eligibility

• Purpose: GET /api/admin/social-location/eligibility handled by socialLocationAdmin.ts; admin social location eligibility route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLocationAdmin.ts:35
• Mounted prefix: /api
• Route module: socialLocationAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/social-location/eligibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-location/eligibility", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

330. POST /api/admin/social-location/eligibility

• Purpose: POST /api/admin/social-location/eligibility handled by socialLocationAdmin.ts; admin social location eligibility route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLocationAdmin.ts:48
• Mounted prefix: /api
• Route module: socialLocationAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/social-location/eligibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-location/eligibility", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

331. DELETE /api/admin/social-location/eligibility/:accountId

• Purpose: DELETE /api/admin/social-location/eligibility/:accountId handled by socialLocationAdmin.ts; admin social location eligibility accountId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLocationAdmin.ts:68
• Mounted prefix: /api
• Route module: socialLocationAdmin.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/social-location/eligibility/:accountId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/social-location/eligibility/:accountId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

332. POST /api/assets

• Purpose: POST /api/assets handled by assets.ts; assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:863
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

333. GET /api/assets/agreements

• Purpose: GET /api/assets/agreements handled by assets.ts; assets agreements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:804
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/agreements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/agreements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

334. POST /api/assets/agreements

• Purpose: POST /api/assets/agreements handled by assets.ts; assets agreements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:819
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/agreements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/agreements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

335. GET /api/assets/alerts

• Purpose: GET /api/assets/alerts handled by assets.ts; assets alerts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2085
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/alerts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/alerts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

336. GET /api/assets/audits

• Purpose: GET /api/assets/audits handled by assets.ts; assets audits route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:576
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/audits" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

337. POST /api/assets/audits/:id/count-sheet/validate

• Purpose: POST /api/assets/audits/:id/count-sheet/validate handled by assets.ts; assets audits id count sheet validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2051
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/audits/:id/count-sheet/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits/:id/count-sheet/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

338. GET /api/assets/audits/:id/results

• Purpose: GET /api/assets/audits/:id/results handled by assets.ts; assets audits id results route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:594
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/audits/:id/results" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits/:id/results", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

339. GET /api/assets/capabilities

• Purpose: GET /api/assets/capabilities handled by assets.ts; assets capabilities route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2397
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/capabilities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/capabilities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

340. PUT /api/assets/capabilities/:key

• Purpose: PUT /api/assets/capabilities/:key handled by assets.ts; assets capabilities key route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2411
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: key
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/capabilities/:key" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/capabilities/:key", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

341. GET /api/assets/catalog

• Purpose: GET /api/assets/catalog handled by assets.ts; assets catalog route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:712
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/catalog" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

342. POST /api/assets/catalog/categories

• Purpose: POST /api/assets/catalog/categories handled by assets.ts; assets catalog categories route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:737
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/catalog/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

343. POST /api/assets/catalog/models

• Purpose: POST /api/assets/catalog/models handled by assets.ts; assets catalog models route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:754
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/catalog/models" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog/models", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

344. GET /api/assets/checkouts

• Purpose: GET /api/assets/checkouts handled by assets.ts; assets checkouts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:999
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/checkouts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

345. POST /api/assets/checkouts

• Purpose: POST /api/assets/checkouts handled by assets.ts; assets checkouts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:982
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

346. POST /api/assets/checkouts/:id/acknowledge

• Purpose: POST /api/assets/checkouts/:id/acknowledge handled by assets.ts; assets checkouts id acknowledge route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1033
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts/:id/acknowledge" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/acknowledge", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

347. GET /api/assets/checkouts/:id/eligibility

• Purpose: GET /api/assets/checkouts/:id/eligibility handled by assets.ts; assets checkouts id eligibility route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1045
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/checkouts/:id/eligibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/eligibility", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

348. POST /api/assets/checkouts/:id/return

• Purpose: POST /api/assets/checkouts/:id/return handled by assets.ts; assets checkouts id return route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1071
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts/:id/return" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/return", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

349. POST /api/assets/containers/:id/pack

• Purpose: POST /api/assets/containers/:id/pack handled by assets.ts; assets containers id pack route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1150
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/containers/:id/pack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/containers/:id/pack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

350. DELETE /api/assets/drafts/:workflowKey

• Purpose: DELETE /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1912
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

351. GET /api/assets/drafts/:workflowKey

• Purpose: GET /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1893
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

352. PUT /api/assets/drafts/:workflowKey

• Purpose: PUT /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1902
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

353. GET /api/assets/eligible-users

• Purpose: GET /api/assets/eligible-users handled by assets.ts; assets eligible users route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:517
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/eligible-users" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/eligible-users", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

354. GET /api/assets/evidence

• Purpose: GET /api/assets/evidence handled by assets.ts; assets evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2280
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

355. POST /api/assets/evidence

• Purpose: POST /api/assets/evidence handled by assets.ts; assets evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2198
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

356. GET /api/assets/evidence/:id/content

• Purpose: GET /api/assets/evidence/:id/content handled by assets.ts; assets evidence id content route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2302
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/evidence/:id/content" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence/:id/content", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

357. POST /api/assets/evidence/:id/review

• Purpose: POST /api/assets/evidence/:id/review handled by assets.ts; assets evidence id review route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2350
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/evidence/:id/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence/:id/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

358. GET /api/assets/finance/adapters/:format

• Purpose: GET /api/assets/finance/adapters/:format handled by assets.ts; assets finance adapters format route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2383
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: format
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/adapters/:format" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/adapters/:format", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

359. GET /api/assets/finance/context

• Purpose: GET /api/assets/finance/context handled by assets.ts; assets finance context route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1219
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/context" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/context", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

360. GET /api/assets/finance/rollforward

• Purpose: GET /api/assets/finance/rollforward handled by assets.ts; assets finance rollforward route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1199
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/rollforward" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/rollforward", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

361. POST /api/assets/finance/value-entries

• Purpose: POST /api/assets/finance/value-entries handled by assets.ts; assets finance value entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1231
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/finance/value-entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/value-entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

362. GET /api/assets/hub/overview

• Purpose: GET /api/assets/hub/overview handled by assets.ts; assets hub overview route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1314
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/overview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/overview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

363. GET /api/assets/hub/records

• Purpose: GET /api/assets/hub/records handled by assets.ts; assets hub records route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1430
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

364. GET /api/assets/hub/summary

• Purpose: GET /api/assets/hub/summary handled by assets.ts; assets hub summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1331
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

365. GET /api/assets/hub/tasks

• Purpose: GET /api/assets/hub/tasks handled by assets.ts; assets hub tasks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1377
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/tasks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/tasks", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

366. POST /api/assets/hub/tasks/assign

• Purpose: POST /api/assets/hub/tasks/assign handled by assets.ts; assets hub tasks assign route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1694
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/hub/tasks/assign" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/tasks/assign", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

367. POST /api/assets/identifiers/issue

• Purpose: POST /api/assets/identifiers/issue handled by assets.ts; assets identifiers issue route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:906
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/identifiers/issue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/identifiers/issue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

368. GET /api/assets/imports/:id

• Purpose: GET /api/assets/imports/:id handled by assets.ts; assets imports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2070
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/imports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/imports/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

369. POST /api/assets/imports/csv/validate

• Purpose: POST /api/assets/imports/csv/validate handled by assets.ts; assets imports csv validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2030
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/imports/csv/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/imports/csv/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

370. GET /api/assets/interoperability/epcis

• Purpose: GET /api/assets/interoperability/epcis handled by assets.ts; assets interoperability epcis route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2010
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/interoperability/epcis" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/interoperability/epcis", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

371. GET /api/assets/interoperability/snapshot

• Purpose: GET /api/assets/interoperability/snapshot handled by assets.ts; assets interoperability snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2000
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/interoperability/snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/interoperability/snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

372. GET /api/assets/items/:id

• Purpose: GET /api/assets/items/:id handled by assets.ts; assets items id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:552
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/items/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/items/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

373. POST /api/assets/items/:id/activate

• Purpose: POST /api/assets/items/:id/activate handled by assets.ts; assets items id activate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:891
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/items/:id/activate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/items/:id/activate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

374. GET /api/assets/loaned

• Purpose: GET /api/assets/loaned handled by assets.ts; assets loaned route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:475
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/loaned" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/loaned", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

375. GET /api/assets/locations

• Purpose: GET /api/assets/locations handled by assets.ts; assets locations route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:677
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/locations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/locations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

376. POST /api/assets/locations

• Purpose: POST /api/assets/locations handled by assets.ts; assets locations route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:691
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/locations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/locations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

377. GET /api/assets/movements

• Purpose: GET /api/assets/movements handled by assets.ts; assets movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:839
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

378. GET /api/assets/openapi.json

• Purpose: GET /api/assets/openapi.json handled by assets.ts; assets openapi.json route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:375
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/openapi.json" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/openapi.json", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

379. GET /api/assets/owned

• Purpose: GET /api/assets/owned handled by assets.ts; assets owned route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:474
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/owned" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/owned", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

380. GET /api/assets/parties

• Purpose: GET /api/assets/parties handled by assets.ts; assets parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:771
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/parties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

381. POST /api/assets/parties

• Purpose: POST /api/assets/parties handled by assets.ts; assets parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:785
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/parties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

382. GET /api/assets/policies

• Purpose: GET /api/assets/policies handled by assets.ts; assets policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1979
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

383. POST /api/assets/policies

• Purpose: POST /api/assets/policies handled by assets.ts; assets policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1921
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

384. GET /api/assets/policies/:id

• Purpose: GET /api/assets/policies/:id handled by assets.ts; assets policies id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1971
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/policies/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

385. POST /api/assets/policies/:id/decision

• Purpose: POST /api/assets/policies/:id/decision handled by assets.ts; assets policies id decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1961
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies/:id/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

386. POST /api/assets/policies/:id/submit

• Purpose: POST /api/assets/policies/:id/submit handled by assets.ts; assets policies id submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1951
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies/:id/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

387. GET /api/assets/saved-views

• Purpose: GET /api/assets/saved-views handled by assets.ts; assets saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:477
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

388. POST /api/assets/saved-views

• Purpose: POST /api/assets/saved-views handled by assets.ts; assets saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:491
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

389. DELETE /api/assets/saved-views/:id

• Purpose: DELETE /api/assets/saved-views/:id handled by assets.ts; assets saved views id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:505
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/assets/saved-views/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

390. POST /api/assets/scan/resolve

• Purpose: POST /api/assets/scan/resolve handled by assets.ts; assets scan resolve route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:931
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/scan/resolve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/scan/resolve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

391. GET /api/assets/search

• Purpose: GET /api/assets/search handled by assets.ts; assets search route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:659
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

392. GET /api/assets/settings/records

• Purpose: GET /api/assets/settings/records handled by assets.ts; assets settings records route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1452
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/settings/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/settings/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

393. GET /api/assets/shipments

• Purpose: GET /api/assets/shipments handled by assets.ts; assets shipments route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1109
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/shipments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

394. POST /api/assets/shipments

• Purpose: POST /api/assets/shipments handled by assets.ts; assets shipments route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1092
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

395. POST /api/assets/shipments/:id/containers

• Purpose: POST /api/assets/shipments/:id/containers handled by assets.ts; assets shipments id containers route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1131
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/containers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/containers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

396. POST /api/assets/shipments/:id/dispatch

• Purpose: POST /api/assets/shipments/:id/dispatch handled by assets.ts; assets shipments id dispatch route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1170
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/dispatch" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/dispatch", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

397. POST /api/assets/shipments/:id/receive

• Purpose: POST /api/assets/shipments/:id/receive handled by assets.ts; assets shipments id receive route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1184
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/receive" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/receive", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

398. GET /api/assets/summary

• Purpose: GET /api/assets/summary handled by assets.ts; assets summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:380
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

399. GET /api/assets/transit-exceptions

• Purpose: GET /api/assets/transit-exceptions handled by assets.ts; assets transit exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:625
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/transit-exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/transit-exceptions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

400. GET /api/assets/webhooks

• Purpose: GET /api/assets/webhooks handled by assets.ts; assets webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2122
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

401. POST /api/assets/webhooks

• Purpose: POST /api/assets/webhooks handled by assets.ts; assets webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2099
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

402. PUT /api/assets/webhooks/:id

• Purpose: PUT /api/assets/webhooks/:id handled by assets.ts; assets webhooks id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2133
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/webhooks/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

403. GET /api/assets/webhooks/:id/deliveries

• Purpose: GET /api/assets/webhooks/:id/deliveries handled by assets.ts; assets webhooks id deliveries route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2186
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/webhooks/:id/deliveries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id/deliveries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

404. POST /api/assets/webhooks/:id/test

• Purpose: POST /api/assets/webhooks/:id/test handled by assets.ts; assets webhooks id test route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2166
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/webhooks/:id/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

405. GET /api/assets/work-orders

• Purpose: GET /api/assets/work-orders handled by assets.ts; assets work orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:609
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/work-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/work-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

406. GET /api/assets/work-orders/:id

• Purpose: GET /api/assets/work-orders/:id handled by assets.ts; assets work orders id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:632
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/work-orders/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/work-orders/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

407. GET /api/assets/workflow-cases

• Purpose: GET /api/assets/workflow-cases handled by assets.ts; assets workflow cases route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1754
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/workflow-cases" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

408. POST /api/assets/workflow-cases

• Purpose: POST /api/assets/workflow-cases handled by assets.ts; assets workflow cases route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1861
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/workflow-cases" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

409. GET /api/assets/workflow-cases/:id

• Purpose: GET /api/assets/workflow-cases/:id handled by assets.ts; assets workflow cases id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1796
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/workflow-cases/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

410. POST /api/assets/workflow-cases/:id/decision

• Purpose: POST /api/assets/workflow-cases/:id/decision handled by assets.ts; assets workflow cases id decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1826
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/workflow-cases/:id/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases/:id/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

411. GET /api/attendee-accounts/lookup

• Purpose: GET /api/attendee-accounts/lookup handled by attendeeAccounts.ts; attendee accounts lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/attendeeAccounts.ts:39
• Mounted prefix: /api
• Route module: attendeeAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/attendee-accounts/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/attendee-accounts/lookup", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

412. GET /api/attendee-accounts/search

• Purpose: GET /api/attendee-accounts/search handled by attendeeAccounts.ts; attendee accounts search route contract must be verified against source before integration.
• Source: partners-api/src/routes/attendeeAccounts.ts:25
• Mounted prefix: /api
• Route module: attendeeAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/attendee-accounts/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/attendee-accounts/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

413. GET /api/events/:eventId/feedback-form

• Purpose: GET /api/events/:eventId/feedback-form handled by eventFeedback.ts; events eventId feedback form route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:129
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-form" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

414. PUT /api/events/:eventId/feedback-form/draft

• Purpose: PUT /api/events/:eventId/feedback-form/draft handled by eventFeedback.ts; events eventId feedback form draft route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:143
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:eventId/feedback-form/draft" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/draft", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

415. POST /api/events/:eventId/feedback-form/publish

• Purpose: POST /api/events/:eventId/feedback-form/publish handled by eventFeedback.ts; events eventId feedback form publish route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:203
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

416. POST /api/events/:eventId/feedback-form/standard-template

• Purpose: POST /api/events/:eventId/feedback-form/standard-template handled by eventFeedback.ts; events eventId feedback form standard template route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:177
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/standard-template" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/standard-template", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

417. GET /api/events/:eventId/feedback-submissions

• Purpose: GET /api/events/:eventId/feedback-submissions handled by eventFeedback.ts; events eventId feedback submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:541
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

418. GET /api/events/:eventId/feedback-submissions/:submissionId

• Purpose: GET /api/events/:eventId/feedback-submissions/:submissionId handled by eventFeedback.ts; events eventId feedback submissions submissionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:460
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

419. PATCH /api/events/:eventId/feedback-submissions/:submissionId

• Purpose: PATCH /api/events/:eventId/feedback-submissions/:submissionId handled by eventFeedback.ts; events eventId feedback submissions submissionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:486
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

420. POST /api/events/:eventId/feedback-submissions/:submissionId/notes

• Purpose: POST /api/events/:eventId/feedback-submissions/:submissionId/notes handled by eventFeedback.ts; events eventId feedback submissions submissionId notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:511
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

421. GET /api/events/:eventId/feedback-submissions/export.csv

• Purpose: GET /api/events/:eventId/feedback-submissions/export.csv handled by eventFeedback.ts; events eventId feedback submissions export.csv route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:407
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

422. GET /api/events/:eventId/forecasts

• Purpose: GET /api/events/:eventId/forecasts handled by forecasting.ts; events eventId forecasts route contract must be verified against source before integration.
• Source: partners-api/src/routes/forecasting.ts:47
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/forecasts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

423. PATCH /api/events/:eventId/forecasts/control

• Purpose: PATCH /api/events/:eventId/forecasts/control handled by forecasting.ts; events eventId forecasts control route contract must be verified against source before integration.
• Source: partners-api/src/routes/forecasting.ts:78
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/forecasts/control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts/control", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

424. GET /api/events/:eventId/lan-sync/changes

• Purpose: GET /api/events/:eventId/lan-sync/changes handled by lanSync.ts; events eventId lan sync changes route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:503
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/changes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

425. POST /api/events/:eventId/lan-sync/evidence

• Purpose: POST /api/events/:eventId/lan-sync/evidence handled by lanSync.ts; events eventId lan sync evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:404
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

426. GET /api/events/:eventId/lan-sync/health

• Purpose: GET /api/events/:eventId/lan-sync/health handled by lanSync.ts; events eventId lan sync health route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:334
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

427. POST /api/events/:eventId/lan-sync/operations

• Purpose: POST /api/events/:eventId/lan-sync/operations handled by lanSync.ts; events eventId lan sync operations route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:349
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/operations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/operations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

428. GET /api/events/:eventId/lan-sync/sessions

• Purpose: GET /api/events/:eventId/lan-sync/sessions handled by lanSync.ts; events eventId lan sync sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:266
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

429. POST /api/events/:eventId/lan-sync/sessions

• Purpose: POST /api/events/:eventId/lan-sync/sessions handled by lanSync.ts; events eventId lan sync sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:280
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

430. POST /api/events/:eventId/lan-sync/sessions/:sessionId/revoke

• Purpose: POST /api/events/:eventId/lan-sync/sessions/:sessionId/revoke handled by lanSync.ts; events eventId lan sync sessions sessionId revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:317
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions/:sessionId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions/:sessionId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

431. GET /api/events/:id/shop/cart

• Purpose: GET /api/events/:id/shop/cart handled by eventShop.ts; events id shop cart route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1573
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/cart" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

432. POST /api/events/:id/shop/cart/items

• Purpose: POST /api/events/:id/shop/cart/items handled by eventShop.ts; events id shop cart items route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1584
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

433. DELETE /api/events/:id/shop/cart/items/:listingId

• Purpose: DELETE /api/events/:id/shop/cart/items/:listingId handled by eventShop.ts; events id shop cart items listingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1624
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/cart/items/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

434. POST /api/events/:id/shop/cart/validate

• Purpose: POST /api/events/:id/shop/cart/validate handled by eventShop.ts; events id shop cart validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1643
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

435. POST /api/events/:id/shop/categories

• Purpose: POST /api/events/:id/shop/categories handled by eventShop.ts; events id shop categories route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1483
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

436. DELETE /api/events/:id/shop/categories/:categoryId

• Purpose: DELETE /api/events/:id/shop/categories/:categoryId handled by eventShop.ts; events id shop categories categoryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1515
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, categoryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/categories/:categoryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/:categoryId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

437. PUT /api/events/:id/shop/categories/order

• Purpose: PUT /api/events/:id/shop/categories/order handled by eventShop.ts; events id shop categories order route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1502
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/categories/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

438. POST /api/events/:id/shop/checkout

• Purpose: POST /api/events/:id/shop/checkout handled by eventShop.ts; events id shop checkout route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1654
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/checkout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/checkout", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

439. POST /api/events/:id/shop/claim/lookup

• Purpose: POST /api/events/:id/shop/claim/lookup handled by eventShop.ts; events id shop claim lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2468
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/claim/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/claim/lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

440. GET /api/events/:id/shop/config

• Purpose: GET /api/events/:id/shop/config handled by eventShop.ts; events id shop config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1342
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

441. POST /api/events/:id/shop/config

• Purpose: POST /api/events/:id/shop/config handled by eventShop.ts; events id shop config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1353
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

442. POST /api/events/:id/shop/couriers

• Purpose: POST /api/events/:id/shop/couriers handled by eventShop.ts; events id shop couriers route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1537
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

443. POST /api/events/:id/shop/couriers/:courierId/rates

• Purpose: POST /api/events/:id/shop/couriers/:courierId/rates handled by eventShop.ts; events id shop couriers courierId rates route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1556
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, courierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers/:courierId/rates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers/:courierId/rates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

444. GET /api/events/:id/shop/listings

• Purpose: GET /api/events/:id/shop/listings handled by eventShop.ts; events id shop listings route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1366
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

445. POST /api/events/:id/shop/listings

• Purpose: POST /api/events/:id/shop/listings handled by eventShop.ts; events id shop listings route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1427
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

446. DELETE /api/events/:id/shop/listings/:listingId

• Purpose: DELETE /api/events/:id/shop/listings/:listingId handled by eventShop.ts; events id shop listings listingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1460
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/listings/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

447. PUT /api/events/:id/shop/listings/order

• Purpose: PUT /api/events/:id/shop/listings/order handled by eventShop.ts; events id shop listings order route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1447
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/listings/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

448. GET /api/events/:id/shop/my-orders

• Purpose: GET /api/events/:id/shop/my-orders handled by eventShop.ts; events id shop my orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1845
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

449. GET /api/events/:id/shop/my-orders/:orderId

• Purpose: GET /api/events/:id/shop/my-orders/:orderId handled by eventShop.ts; events id shop my orders orderId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1860
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

450. POST /api/events/:id/shop/my-orders/:orderId/payment

• Purpose: POST /api/events/:id/shop/my-orders/:orderId/payment handled by eventShop.ts; events id shop my orders orderId payment route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1905
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId/payment" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId/payment", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

451. GET /api/events/:id/shop/orders

• Purpose: GET /api/events/:id/shop/orders handled by eventShop.ts; events id shop orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1972
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

452. GET /api/events/:id/shop/orders/:orderId

• Purpose: GET /api/events/:id/shop/orders/:orderId handled by eventShop.ts; events id shop orders orderId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2106
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

453. POST /api/events/:id/shop/orders/:orderId/claim

• Purpose: POST /api/events/:id/shop/orders/:orderId/claim handled by eventShop.ts; events id shop orders orderId claim route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2300
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

454. POST /api/events/:id/shop/orders/:orderId/claim-exception

• Purpose: POST /api/events/:id/shop/orders/:orderId/claim-exception handled by eventShop.ts; events id shop orders orderId claim exception route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2375
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim-exception" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim-exception", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

455. POST /api/events/:id/shop/orders/:orderId/payment-review

• Purpose: POST /api/events/:id/shop/orders/:orderId/payment-review handled by eventShop.ts; events id shop orders orderId payment review route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2191
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

456. POST /api/events/:id/shop/orders/:orderId/status

• Purpose: POST /api/events/:id/shop/orders/:orderId/status handled by eventShop.ts; events id shop orders orderId status route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2134
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/status", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

457. POST /api/events/:id/shop/orders/:orderId/updates

• Purpose: POST /api/events/:id/shop/orders/:orderId/updates handled by eventShop.ts; events id shop orders orderId updates route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2254
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/updates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/updates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

458. GET /api/events/:id/shop/orders/dashboard

• Purpose: GET /api/events/:id/shop/orders/dashboard handled by eventShop.ts; events id shop orders dashboard route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1995
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/dashboard" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/dashboard", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

459. GET /api/events/:id/shop/public

• Purpose: GET /api/events/:id/shop/public handled by eventShop.ts; events id shop public route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1330
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/public" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/public", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

460. GET /api/events/:id/shop/source-items

• Purpose: GET /api/events/:id/shop/source-items handled by eventShop.ts; events id shop source items route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1378
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/source-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/source-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

461. GET /api/geo/countries

• Purpose: GET /api/geo/countries handled by geo.ts; geo countries route contract must be verified against source before integration.
• Source: partners-api/src/routes/geo.ts:55
• Mounted prefix: /api
• Route module: geo.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/geo/countries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/geo/countries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

462. GET /api/geo/states/:iso2

• Purpose: GET /api/geo/states/:iso2 handled by geo.ts; geo states iso2 route contract must be verified against source before integration.
• Source: partners-api/src/routes/geo.ts:69
• Mounted prefix: /api
• Route module: geo.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: iso2
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/geo/states/:iso2" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/geo/states/:iso2", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

463. GET /api/manage/:eventId/feedback-form

• Purpose: GET /api/manage/:eventId/feedback-form is the Event Management compatibility alias for /api/events/:eventId/feedback-form.
• Source: partners-api/src/routes/eventFeedback.ts:129
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-form" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

464. PUT /api/manage/:eventId/feedback-form/draft

• Purpose: PUT /api/manage/:eventId/feedback-form/draft is the Event Management compatibility alias for /api/events/:eventId/feedback-form/draft.
• Source: partners-api/src/routes/eventFeedback.ts:143
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:eventId/feedback-form/draft" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/draft", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

465. POST /api/manage/:eventId/feedback-form/publish

• Purpose: POST /api/manage/:eventId/feedback-form/publish is the Event Management compatibility alias for /api/events/:eventId/feedback-form/publish.
• Source: partners-api/src/routes/eventFeedback.ts:203
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

466. POST /api/manage/:eventId/feedback-form/standard-template

• Purpose: POST /api/manage/:eventId/feedback-form/standard-template is the Event Management compatibility alias for /api/events/:eventId/feedback-form/standard-template.
• Source: partners-api/src/routes/eventFeedback.ts:177
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/standard-template" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/standard-template", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

467. GET /api/manage/:eventId/feedback-submissions

• Purpose: GET /api/manage/:eventId/feedback-submissions is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions.
• Source: partners-api/src/routes/eventFeedback.ts:541
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

468. GET /api/manage/:eventId/feedback-submissions/:submissionId

• Purpose: GET /api/manage/:eventId/feedback-submissions/:submissionId is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId.
• Source: partners-api/src/routes/eventFeedback.ts:460
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

469. PATCH /api/manage/:eventId/feedback-submissions/:submissionId

• Purpose: PATCH /api/manage/:eventId/feedback-submissions/:submissionId is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId.
• Source: partners-api/src/routes/eventFeedback.ts:486
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

470. POST /api/manage/:eventId/feedback-submissions/:submissionId/notes

• Purpose: POST /api/manage/:eventId/feedback-submissions/:submissionId/notes is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId/notes.
• Source: partners-api/src/routes/eventFeedback.ts:511
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

471. GET /api/manage/:eventId/feedback-submissions/export.csv

• Purpose: GET /api/manage/:eventId/feedback-submissions/export.csv is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/export.csv.
• Source: partners-api/src/routes/eventFeedback.ts:407
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

472. GET /api/manage/:eventId/forecasts

• Purpose: GET /api/manage/:eventId/forecasts is the Event Management compatibility alias for /api/events/:eventId/forecasts.
• Source: partners-api/src/routes/forecasting.ts:47
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/forecasts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

473. PATCH /api/manage/:eventId/forecasts/control

• Purpose: PATCH /api/manage/:eventId/forecasts/control is the Event Management compatibility alias for /api/events/:eventId/forecasts/control.
• Source: partners-api/src/routes/forecasting.ts:78
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/forecasts/control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts/control", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

474. GET /api/manage/:eventId/lan-sync/changes

• Purpose: GET /api/manage/:eventId/lan-sync/changes is the Event Management compatibility alias for /api/events/:eventId/lan-sync/changes.
• Source: partners-api/src/routes/lanSync.ts:503
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/changes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

475. POST /api/manage/:eventId/lan-sync/evidence

• Purpose: POST /api/manage/:eventId/lan-sync/evidence is the Event Management compatibility alias for /api/events/:eventId/lan-sync/evidence.
• Source: partners-api/src/routes/lanSync.ts:404
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

476. GET /api/manage/:eventId/lan-sync/health

• Purpose: GET /api/manage/:eventId/lan-sync/health is the Event Management compatibility alias for /api/events/:eventId/lan-sync/health.
• Source: partners-api/src/routes/lanSync.ts:334
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

477. POST /api/manage/:eventId/lan-sync/operations

• Purpose: POST /api/manage/:eventId/lan-sync/operations is the Event Management compatibility alias for /api/events/:eventId/lan-sync/operations.
• Source: partners-api/src/routes/lanSync.ts:349
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/operations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/operations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

478. GET /api/manage/:eventId/lan-sync/sessions

• Purpose: GET /api/manage/:eventId/lan-sync/sessions is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions.
• Source: partners-api/src/routes/lanSync.ts:266
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

479. POST /api/manage/:eventId/lan-sync/sessions

• Purpose: POST /api/manage/:eventId/lan-sync/sessions is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions.
• Source: partners-api/src/routes/lanSync.ts:280
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

480. POST /api/manage/:eventId/lan-sync/sessions/:sessionId/revoke

• Purpose: POST /api/manage/:eventId/lan-sync/sessions/:sessionId/revoke is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions/:sessionId/revoke.
• Source: partners-api/src/routes/lanSync.ts:317
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions/:sessionId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions/:sessionId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

481. GET /api/manage/:id/shop/cart

• Purpose: GET /api/manage/:id/shop/cart is the Event Management compatibility alias for /api/events/:id/shop/cart.
• Source: partners-api/src/routes/eventShop.ts:1573
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/cart" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

482. POST /api/manage/:id/shop/cart/items

• Purpose: POST /api/manage/:id/shop/cart/items is the Event Management compatibility alias for /api/events/:id/shop/cart/items.
• Source: partners-api/src/routes/eventShop.ts:1584
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

483. DELETE /api/manage/:id/shop/cart/items/:listingId

• Purpose: DELETE /api/manage/:id/shop/cart/items/:listingId is the Event Management compatibility alias for /api/events/:id/shop/cart/items/:listingId.
• Source: partners-api/src/routes/eventShop.ts:1624
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/cart/items/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

484. POST /api/manage/:id/shop/cart/validate

• Purpose: POST /api/manage/:id/shop/cart/validate is the Event Management compatibility alias for /api/events/:id/shop/cart/validate.
• Source: partners-api/src/routes/eventShop.ts:1643
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

485. POST /api/manage/:id/shop/categories

• Purpose: POST /api/manage/:id/shop/categories is the Event Management compatibility alias for /api/events/:id/shop/categories.
• Source: partners-api/src/routes/eventShop.ts:1483
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

486. DELETE /api/manage/:id/shop/categories/:categoryId

• Purpose: DELETE /api/manage/:id/shop/categories/:categoryId is the Event Management compatibility alias for /api/events/:id/shop/categories/:categoryId.
• Source: partners-api/src/routes/eventShop.ts:1515
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, categoryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/categories/:categoryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/:categoryId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

487. PUT /api/manage/:id/shop/categories/order

• Purpose: PUT /api/manage/:id/shop/categories/order is the Event Management compatibility alias for /api/events/:id/shop/categories/order.
• Source: partners-api/src/routes/eventShop.ts:1502
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/categories/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

488. POST /api/manage/:id/shop/checkout

• Purpose: POST /api/manage/:id/shop/checkout is the Event Management compatibility alias for /api/events/:id/shop/checkout.
• Source: partners-api/src/routes/eventShop.ts:1654
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/checkout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/checkout", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

489. POST /api/manage/:id/shop/claim/lookup

• Purpose: POST /api/manage/:id/shop/claim/lookup is the Event Management compatibility alias for /api/events/:id/shop/claim/lookup.
• Source: partners-api/src/routes/eventShop.ts:2468
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/claim/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/claim/lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

490. GET /api/manage/:id/shop/config

• Purpose: GET /api/manage/:id/shop/config is the Event Management compatibility alias for /api/events/:id/shop/config.
• Source: partners-api/src/routes/eventShop.ts:1342
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

491. POST /api/manage/:id/shop/config

• Purpose: POST /api/manage/:id/shop/config is the Event Management compatibility alias for /api/events/:id/shop/config.
• Source: partners-api/src/routes/eventShop.ts:1353
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

492. POST /api/manage/:id/shop/couriers

• Purpose: POST /api/manage/:id/shop/couriers is the Event Management compatibility alias for /api/events/:id/shop/couriers.
• Source: partners-api/src/routes/eventShop.ts:1537
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

493. POST /api/manage/:id/shop/couriers/:courierId/rates

• Purpose: POST /api/manage/:id/shop/couriers/:courierId/rates is the Event Management compatibility alias for /api/events/:id/shop/couriers/:courierId/rates.
• Source: partners-api/src/routes/eventShop.ts:1556
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, courierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers/:courierId/rates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers/:courierId/rates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

494. GET /api/manage/:id/shop/listings

• Purpose: GET /api/manage/:id/shop/listings is the Event Management compatibility alias for /api/events/:id/shop/listings.
• Source: partners-api/src/routes/eventShop.ts:1366
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

495. POST /api/manage/:id/shop/listings

• Purpose: POST /api/manage/:id/shop/listings is the Event Management compatibility alias for /api/events/:id/shop/listings.
• Source: partners-api/src/routes/eventShop.ts:1427
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

496. DELETE /api/manage/:id/shop/listings/:listingId

• Purpose: DELETE /api/manage/:id/shop/listings/:listingId is the Event Management compatibility alias for /api/events/:id/shop/listings/:listingId.
• Source: partners-api/src/routes/eventShop.ts:1460
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/listings/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

497. PUT /api/manage/:id/shop/listings/order

• Purpose: PUT /api/manage/:id/shop/listings/order is the Event Management compatibility alias for /api/events/:id/shop/listings/order.
• Source: partners-api/src/routes/eventShop.ts:1447
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/listings/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

498. GET /api/manage/:id/shop/my-orders

• Purpose: GET /api/manage/:id/shop/my-orders is the Event Management compatibility alias for /api/events/:id/shop/my-orders.
• Source: partners-api/src/routes/eventShop.ts:1845
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

499. GET /api/manage/:id/shop/my-orders/:orderId

• Purpose: GET /api/manage/:id/shop/my-orders/:orderId is the Event Management compatibility alias for /api/events/:id/shop/my-orders/:orderId.
• Source: partners-api/src/routes/eventShop.ts:1860
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

500. POST /api/manage/:id/shop/my-orders/:orderId/payment

• Purpose: POST /api/manage/:id/shop/my-orders/:orderId/payment is the Event Management compatibility alias for /api/events/:id/shop/my-orders/:orderId/payment.
• Source: partners-api/src/routes/eventShop.ts:1905
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId/payment" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId/payment", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

501. GET /api/manage/:id/shop/orders

• Purpose: GET /api/manage/:id/shop/orders is the Event Management compatibility alias for /api/events/:id/shop/orders.
• Source: partners-api/src/routes/eventShop.ts:1972
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

502. GET /api/manage/:id/shop/orders/:orderId

• Purpose: GET /api/manage/:id/shop/orders/:orderId is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId.
• Source: partners-api/src/routes/eventShop.ts:2106
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

503. POST /api/manage/:id/shop/orders/:orderId/claim

• Purpose: POST /api/manage/:id/shop/orders/:orderId/claim is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/claim.
• Source: partners-api/src/routes/eventShop.ts:2300
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

504. POST /api/manage/:id/shop/orders/:orderId/claim-exception

• Purpose: POST /api/manage/:id/shop/orders/:orderId/claim-exception is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/claim-exception.
• Source: partners-api/src/routes/eventShop.ts:2375
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim-exception" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim-exception", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

505. POST /api/manage/:id/shop/orders/:orderId/payment-review

• Purpose: POST /api/manage/:id/shop/orders/:orderId/payment-review is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/payment-review.
• Source: partners-api/src/routes/eventShop.ts:2191
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

506. POST /api/manage/:id/shop/orders/:orderId/status

• Purpose: POST /api/manage/:id/shop/orders/:orderId/status is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/status.
• Source: partners-api/src/routes/eventShop.ts:2134
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/status", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

507. POST /api/manage/:id/shop/orders/:orderId/updates

• Purpose: POST /api/manage/:id/shop/orders/:orderId/updates is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/updates.
• Source: partners-api/src/routes/eventShop.ts:2254
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/updates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/updates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

508. GET /api/manage/:id/shop/orders/dashboard

• Purpose: GET /api/manage/:id/shop/orders/dashboard is the Event Management compatibility alias for /api/events/:id/shop/orders/dashboard.
• Source: partners-api/src/routes/eventShop.ts:1995
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/dashboard" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/dashboard", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

509. GET /api/manage/:id/shop/public

• Purpose: GET /api/manage/:id/shop/public is the Event Management compatibility alias for /api/events/:id/shop/public.
• Source: partners-api/src/routes/eventShop.ts:1330
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/public" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/public", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

510. GET /api/manage/:id/shop/source-items

• Purpose: GET /api/manage/:id/shop/source-items is the Event Management compatibility alias for /api/events/:id/shop/source-items.
• Source: partners-api/src/routes/eventShop.ts:1378
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/source-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/source-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

511. GET /api/partners/:partnerId/finance/access

• Purpose: GET /api/partners/:partnerId/finance/access handled by partnerFinance.ts; partners partnerId finance access route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:328
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

512. GET /api/partners/:partnerId/finance/accounts

• Purpose: GET /api/partners/:partnerId/finance/accounts handled by partnerFinance.ts; partners partnerId finance accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:350
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

513. GET /api/partners/:partnerId/finance/audit

• Purpose: GET /api/partners/:partnerId/finance/audit handled by partnerFinance.ts; partners partnerId finance audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1799
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

514. PUT /api/partners/:partnerId/finance/cash-accounts

• Purpose: PUT /api/partners/:partnerId/finance/cash-accounts handled by partnerFinance.ts; partners partnerId finance cash accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:374
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/cash-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/cash-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

515. GET /api/partners/:partnerId/finance/continuity-runs

• Purpose: GET /api/partners/:partnerId/finance/continuity-runs handled by partnerFinance.ts; partners partnerId finance continuity runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1465
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/continuity-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/continuity-runs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

516. POST /api/partners/:partnerId/finance/continuity-runs

• Purpose: POST /api/partners/:partnerId/finance/continuity-runs handled by partnerFinance.ts; partners partnerId finance continuity runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1474
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/continuity-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/continuity-runs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

517. GET /api/partners/:partnerId/finance/controls

• Purpose: GET /api/partners/:partnerId/finance/controls handled by partnerFinance.ts; partners partnerId finance controls route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1456
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/controls" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/controls", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

518. GET /api/partners/:partnerId/finance/counterparties

• Purpose: GET /api/partners/:partnerId/finance/counterparties handled by partnerFinance.ts; partners partnerId finance counterparties route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1056
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/counterparties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/counterparties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

519. POST /api/partners/:partnerId/finance/counterparties

• Purpose: POST /api/partners/:partnerId/finance/counterparties handled by partnerFinance.ts; partners partnerId finance counterparties route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1073
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/counterparties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/counterparties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

520. GET /api/partners/:partnerId/finance/custody-sessions

• Purpose: GET /api/partners/:partnerId/finance/custody-sessions handled by partnerFinance.ts; partners partnerId finance custody sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1281
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

521. POST /api/partners/:partnerId/finance/custody-sessions

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions handled by partnerFinance.ts; partners partnerId finance custody sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1290
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

522. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId accept handover route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1357
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

523. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/close

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/close handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1377
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

524. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/handover

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/handover handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId handover route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1335
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

525. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/movements

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/movements handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1311
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

526. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId review close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1399
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

527. GET /api/partners/:partnerId/finance/default-payment-accounts

• Purpose: GET /api/partners/:partnerId/finance/default-payment-accounts handled by partnerFinance.ts; partners partnerId finance default payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:431
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/default-payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/default-payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

528. PUT /api/partners/:partnerId/finance/default-payment-accounts

• Purpose: PUT /api/partners/:partnerId/finance/default-payment-accounts handled by partnerFinance.ts; partners partnerId finance default payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:461
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/default-payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/default-payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

529. GET /api/partners/:partnerId/finance/disbursements

• Purpose: GET /api/partners/:partnerId/finance/disbursements handled by partnerFinance.ts; partners partnerId finance disbursements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:729
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/disbursements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

530. POST /api/partners/:partnerId/finance/disbursements

• Purpose: POST /api/partners/:partnerId/finance/disbursements handled by partnerFinance.ts; partners partnerId finance disbursements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1591
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/disbursements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

531. POST /api/partners/:partnerId/finance/disbursements/:requestId/actions

• Purpose: POST /api/partners/:partnerId/finance/disbursements/:requestId/actions handled by partnerFinance.ts; partners partnerId finance disbursements requestId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1632
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/disbursements/:requestId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements/:requestId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

532. GET /api/partners/:partnerId/finance/disbursements/:requestId/evidence/download

• Purpose: GET /api/partners/:partnerId/finance/disbursements/:requestId/evidence/download handled by partnerFinance.ts; partners partnerId finance disbursements requestId evidence download route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:766
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/disbursements/:requestId/evidence/download" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements/:requestId/evidence/download", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

533. POST /api/partners/:partnerId/finance/entries

• Purpose: POST /api/partners/:partnerId/finance/entries handled by partnerFinance.ts; partners partnerId finance entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:590
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

534. POST /api/partners/:partnerId/finance/entries/:entryId/allocations

• Purpose: POST /api/partners/:partnerId/finance/entries/:entryId/allocations handled by partnerFinance.ts; partners partnerId finance entries entryId allocations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:645
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries/:entryId/allocations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries/:entryId/allocations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

535. POST /api/partners/:partnerId/finance/entries/:entryId/reverse

• Purpose: POST /api/partners/:partnerId/finance/entries/:entryId/reverse handled by partnerFinance.ts; partners partnerId finance entries entryId reverse route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:626
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries/:entryId/reverse" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries/:entryId/reverse", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

536. GET /api/partners/:partnerId/finance/events

• Purpose: GET /api/partners/:partnerId/finance/events handled by partnerFinance.ts; partners partnerId finance events route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:672
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

537. POST /api/partners/:partnerId/finance/evidence

• Purpose: POST /api/partners/:partnerId/finance/evidence handled by partnerFinance.ts; partners partnerId finance evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1136
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

538. POST /api/partners/:partnerId/finance/evidence/:evidenceId/access

• Purpose: POST /api/partners/:partnerId/finance/evidence/:evidenceId/access handled by partnerFinance.ts; partners partnerId finance evidence evidenceId access route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1188
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, evidenceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/evidence/:evidenceId/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/evidence/:evidenceId/access", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

539. GET /api/partners/:partnerId/finance/export.csv

• Purpose: GET /api/partners/:partnerId/finance/export.csv handled by partnerFinance.ts; partners partnerId finance export.csv route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1825
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

540. GET /api/partners/:partnerId/finance/history

• Purpose: GET /api/partners/:partnerId/finance/history handled by partnerFinance.ts; partners partnerId finance history route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:502
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

541. GET /api/partners/:partnerId/finance/history/:entryId

• Purpose: GET /api/partners/:partnerId/finance/history/:entryId handled by partnerFinance.ts; partners partnerId finance history entryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:557
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/history/:entryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/history/:entryId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

542. GET /api/partners/:partnerId/finance/imports

• Purpose: GET /api/partners/:partnerId/finance/imports handled by partnerFinance.ts; partners partnerId finance imports route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:824
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/imports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/imports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

543. GET /api/partners/:partnerId/finance/imports/:batchId/rows

• Purpose: GET /api/partners/:partnerId/finance/imports/:batchId/rows handled by partnerFinance.ts; partners partnerId finance imports batchId rows route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:834
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, batchId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/imports/:batchId/rows" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/imports/:batchId/rows", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

544. GET /api/partners/:partnerId/finance/integrations/health

• Purpose: GET /api/partners/:partnerId/finance/integrations/health handled by partnerFinance.ts; partners partnerId finance integrations health route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1418
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/integrations/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/integrations/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

545. POST /api/partners/:partnerId/finance/integrations/profiles

• Purpose: POST /api/partners/:partnerId/finance/integrations/profiles handled by partnerFinance.ts; partners partnerId finance integrations profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1435
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/integrations/profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/integrations/profiles", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

546. GET /api/partners/:partnerId/finance/interchange/export

• Purpose: GET /api/partners/:partnerId/finance/interchange/export handled by partnerFinance.ts; partners partnerId finance interchange export route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:936
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/interchange/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

547. GET /api/partners/:partnerId/finance/interchange/profiles

• Purpose: GET /api/partners/:partnerId/finance/interchange/profiles handled by partnerFinance.ts; partners partnerId finance interchange profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:916
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/interchange/profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

548. POST /api/partners/:partnerId/finance/interchange/ubl-invoice-preview

• Purpose: POST /api/partners/:partnerId/finance/interchange/ubl-invoice-preview handled by partnerFinance.ts; partners partnerId finance interchange ubl invoice preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:922
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/interchange/ubl-invoice-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/ubl-invoice-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

549. GET /api/partners/:partnerId/finance/notifications/destinations

• Purpose: GET /api/partners/:partnerId/finance/notifications/destinations handled by partnerFinance.ts; partners partnerId finance notifications destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1720
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/destinations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

550. PUT /api/partners/:partnerId/finance/notifications/destinations

• Purpose: PUT /api/partners/:partnerId/finance/notifications/destinations handled by partnerFinance.ts; partners partnerId finance notifications destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1734
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/notifications/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/destinations", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

551. GET /api/partners/:partnerId/finance/notifications/discord-channels

• Purpose: GET /api/partners/:partnerId/finance/notifications/discord-channels handled by partnerFinance.ts; partners partnerId finance notifications discord channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1703
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/discord-channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/discord-channels", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

552. GET /api/partners/:partnerId/finance/notifications/options

• Purpose: GET /api/partners/:partnerId/finance/notifications/options handled by partnerFinance.ts; partners partnerId finance notifications options route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1680
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/options", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

553. GET /api/partners/:partnerId/finance/periods

• Purpose: GET /api/partners/:partnerId/finance/periods handled by partnerFinance.ts; partners partnerId finance periods route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1014
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/periods" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

554. POST /api/partners/:partnerId/finance/periods/:periodId/close

• Purpose: POST /api/partners/:partnerId/finance/periods/:periodId/close handled by partnerFinance.ts; partners partnerId finance periods periodId close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1023
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, periodId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/periods/:periodId/close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods/:periodId/close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

555. POST /api/partners/:partnerId/finance/periods/:periodId/reopen

• Purpose: POST /api/partners/:partnerId/finance/periods/:periodId/reopen handled by partnerFinance.ts; partners partnerId finance periods periodId reopen route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1040
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, periodId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/periods/:periodId/reopen" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods/:periodId/reopen", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

556. GET /api/partners/:partnerId/finance/reconciliation-status

• Purpose: GET /api/partners/:partnerId/finance/reconciliation-status handled by partnerFinance.ts; partners partnerId finance reconciliation status route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:997
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/reconciliation-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliation-status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

557. GET /api/partners/:partnerId/finance/reconciliations

• Purpose: GET /api/partners/:partnerId/finance/reconciliations handled by partnerFinance.ts; partners partnerId finance reconciliations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:963
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

558. POST /api/partners/:partnerId/finance/reconciliations

• Purpose: POST /api/partners/:partnerId/finance/reconciliations handled by partnerFinance.ts; partners partnerId finance reconciliations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:972
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

559. POST /api/partners/:partnerId/finance/reconciliations/import-preview

• Purpose: POST /api/partners/:partnerId/finance/reconciliations/import-preview handled by partnerFinance.ts; partners partnerId finance reconciliations import preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:876
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations/import-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations/import-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

560. GET /api/partners/:partnerId/finance/records

• Purpose: GET /api/partners/:partnerId/finance/records handled by partnerFinance.ts; partners partnerId finance records route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1094
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

561. POST /api/partners/:partnerId/finance/records

• Purpose: POST /api/partners/:partnerId/finance/records handled by partnerFinance.ts; partners partnerId finance records route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1210
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

562. GET /api/partners/:partnerId/finance/records/:recordId

• Purpose: GET /api/partners/:partnerId/finance/records/:recordId handled by partnerFinance.ts; partners partnerId finance records recordId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1109
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/records/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records/:recordId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

563. POST /api/partners/:partnerId/finance/records/:recordId/actions

• Purpose: POST /api/partners/:partnerId/finance/records/:recordId/actions handled by partnerFinance.ts; partners partnerId finance records recordId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1247
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/records/:recordId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records/:recordId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

564. GET /api/partners/:partnerId/finance/summary

• Purpose: GET /api/partners/:partnerId/finance/summary handled by partnerFinance.ts; partners partnerId finance summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:334
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

565. POST /api/partners/:partnerId/finance/work-locks

• Purpose: POST /api/partners/:partnerId/finance/work-locks handled by partnerFinance.ts; partners partnerId finance work locks route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1526
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/work-locks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

566. DELETE /api/partners/:partnerId/finance/work-locks/:lockId

• Purpose: DELETE /api/partners/:partnerId/finance/work-locks/:lockId handled by partnerFinance.ts; partners partnerId finance work locks lockId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1576
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, lockId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/partners/:partnerId/finance/work-locks/:lockId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks/:lockId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

567. POST /api/partners/:partnerId/finance/work-locks/:lockId/heartbeat

• Purpose: POST /api/partners/:partnerId/finance/work-locks/:lockId/heartbeat handled by partnerFinance.ts; partners partnerId finance work locks lockId heartbeat route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1561
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, lockId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

568. GET /api/partners/:partnerId/operations-linkage/access

• Purpose: GET /api/partners/:partnerId/operations-linkage/access handled by operationsLinkage.ts; partners partnerId operations linkage access route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1400
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

569. GET /api/partners/:partnerId/operations-linkage/coverage

• Purpose: GET /api/partners/:partnerId/operations-linkage/coverage handled by operationsLinkage.ts; partners partnerId operations linkage coverage route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1450
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/coverage" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/coverage", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

570. GET /api/partners/:partnerId/operations-linkage/deployments

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments handled by operationsLinkage.ts; partners partnerId operations linkage deployments route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2313
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

571. POST /api/partners/:partnerId/operations-linkage/deployments

• Purpose: POST /api/partners/:partnerId/operations-linkage/deployments handled by operationsLinkage.ts; partners partnerId operations linkage deployments route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2352
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

572. GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2498
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

573. POST /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2664
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

574. GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId manifest route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2574
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

575. GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/substitutions

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/substitutions handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId substitutions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2641
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/substitutions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/substitutions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

576. GET /api/partners/:partnerId/operations-linkage/dimensions

• Purpose: GET /api/partners/:partnerId/operations-linkage/dimensions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1888
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

577. POST /api/partners/:partnerId/operations-linkage/dimensions

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2032
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

578. GET /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId

• Purpose: GET /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId handled by operationsLinkage.ts; partners partnerId operations linkage dimensions dimensionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1951
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, dimensionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

579. POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/actions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions dimensionId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2111
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, dimensionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

580. POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage dimensions dimensionId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2164
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, dimensionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

581. POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links/:systemLinkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links/:systemLinkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions dimensionId system links systemLinkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2220
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, dimensionId, systemLinkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links/:systemLinkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links/:systemLinkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

582. GET /api/partners/:partnerId/operations-linkage/exceptions

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3818
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

583. POST /api/partners/:partnerId/operations-linkage/exceptions

• Purpose: POST /api/partners/:partnerId/operations-linkage/exceptions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3956
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

584. GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3837
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

585. POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:4025
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

586. GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fix-preview

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fix-preview handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId fix preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3878
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fix-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fix-preview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

587. POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fixes

• Purpose: POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fixes handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId fixes route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3903
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fixes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/fixes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

588. GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/retry-preview

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/retry-preview handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId retry preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3853
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/retry-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/retry-preview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

589. GET /api/partners/:partnerId/operations-linkage/exports

• Purpose: GET /api/partners/:partnerId/operations-linkage/exports handled by operationsLinkage.ts; partners partnerId operations linkage exports route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:4130
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

590. GET /api/partners/:partnerId/operations-linkage/finance/asset-batches

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/asset-batches handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3663
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

591. POST /api/partners/:partnerId/operations-linkage/finance/asset-batches

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-batches handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3736
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

592. POST /api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches batchId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3792
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, batchId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

593. GET /api/partners/:partnerId/operations-linkage/finance/asset-mappings

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/asset-mappings handled by operationsLinkage.ts; partners partnerId operations linkage finance asset mappings route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3580
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-mappings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-mappings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

594. POST /api/partners/:partnerId/operations-linkage/finance/asset-mappings

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-mappings handled by operationsLinkage.ts; partners partnerId operations linkage finance asset mappings route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3598
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-mappings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-mappings", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

595. POST /api/partners/:partnerId/operations-linkage/finance/asset-mappings/:mappingId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-mappings/:mappingId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance asset mappings mappingId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3636
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, mappingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-mappings/:mappingId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-mappings/:mappingId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

596. GET /api/partners/:partnerId/operations-linkage/finance/coding-proposals

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/coding-proposals handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2834
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

597. POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2847
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

598. POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals proposalId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2906
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, proposalId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

599. GET /api/partners/:partnerId/operations-linkage/finance/cost-handoffs

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/cost-handoffs handled by operationsLinkage.ts; partners partnerId operations linkage finance cost handoffs route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3447
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/cost-handoffs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/cost-handoffs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

600. POST /api/partners/:partnerId/operations-linkage/finance/cost-handoffs

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/cost-handoffs handled by operationsLinkage.ts; partners partnerId operations linkage finance cost handoffs route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3484
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/cost-handoffs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/cost-handoffs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

601. POST /api/partners/:partnerId/operations-linkage/finance/cost-handoffs/:handoffId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/cost-handoffs/:handoffId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance cost handoffs handoffId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3545
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, handoffId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/cost-handoffs/:handoffId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/cost-handoffs/:handoffId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

602. GET /api/partners/:partnerId/operations-linkage/finance/dimension-policies

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/dimension-policies handled by operationsLinkage.ts; partners partnerId operations linkage finance dimension policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2222
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/dimension-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/dimension-policies", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

603. POST /api/partners/:partnerId/operations-linkage/finance/dimension-policies

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/dimension-policies handled by operationsLinkage.ts; partners partnerId operations linkage finance dimension policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2246
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/dimension-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/dimension-policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

604. POST /api/partners/:partnerId/operations-linkage/finance/dimension-policies/:policyId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/dimension-policies/:policyId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance dimension policies policyId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2283
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/dimension-policies/:policyId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/dimension-policies/:policyId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

605. POST /api/partners/:partnerId/operations-linkage/finance/ems-annotations/:annotationId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/ems-annotations/:annotationId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance ems annotations annotationId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2954
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, annotationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/ems-annotations/:annotationId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/ems-annotations/:annotationId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

606. GET /api/partners/:partnerId/operations-linkage/finance/ems-reconciliation

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/ems-reconciliation handled by operationsLinkage.ts; partners partnerId operations linkage finance ems reconciliation route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3009
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/ems-reconciliation" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/ems-reconciliation", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

607. GET /api/partners/:partnerId/operations-linkage/finance/ems-sources

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/ems-sources handled by operationsLinkage.ts; partners partnerId operations linkage finance ems sources route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3022
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/ems-sources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/ems-sources", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

608. GET /api/partners/:partnerId/operations-linkage/finance/postings

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/postings handled by operationsLinkage.ts; partners partnerId operations linkage finance postings route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3676
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/postings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/postings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

609. GET /api/partners/:partnerId/operations-linkage/intakes

• Purpose: GET /api/partners/:partnerId/operations-linkage/intakes handled by operationsLinkage.ts; partners partnerId operations linkage intakes route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3316
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/intakes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/intakes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

610. POST /api/partners/:partnerId/operations-linkage/intakes

• Purpose: POST /api/partners/:partnerId/operations-linkage/intakes handled by operationsLinkage.ts; partners partnerId operations linkage intakes route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3358
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/intakes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/intakes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

611. POST /api/partners/:partnerId/operations-linkage/intakes/:intakeId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/intakes/:intakeId/actions handled by operationsLinkage.ts; partners partnerId operations linkage intakes intakeId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3399
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, intakeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/intakes/:intakeId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/intakes/:intakeId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

612. GET /api/partners/:partnerId/operations-linkage/links

• Purpose: GET /api/partners/:partnerId/operations-linkage/links handled by operationsLinkage.ts; partners partnerId operations linkage links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1577
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

613. POST /api/partners/:partnerId/operations-linkage/links

• Purpose: POST /api/partners/:partnerId/operations-linkage/links handled by operationsLinkage.ts; partners partnerId operations linkage links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1668
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

614. GET /api/partners/:partnerId/operations-linkage/links/:linkId

• Purpose: GET /api/partners/:partnerId/operations-linkage/links/:linkId handled by operationsLinkage.ts; partners partnerId operations linkage links linkId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1637
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/:linkId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/:linkId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

615. PATCH /api/partners/:partnerId/operations-linkage/links/:linkId

• Purpose: PATCH /api/partners/:partnerId/operations-linkage/links/:linkId handled by operationsLinkage.ts; partners partnerId operations linkage links linkId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1852
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/:linkId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/:linkId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

616. POST /api/partners/:partnerId/operations-linkage/links/:linkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/links/:linkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage links linkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1851
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/:linkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/:linkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

617. GET /api/partners/:partnerId/operations-linkage/links/candidates

• Purpose: GET /api/partners/:partnerId/operations-linkage/links/candidates handled by operationsLinkage.ts; partners partnerId operations linkage links candidates route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1599
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/candidates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/candidates", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

618. GET /api/partners/:partnerId/operations-linkage/metrics

• Purpose: GET /api/partners/:partnerId/operations-linkage/metrics handled by operationsLinkage.ts; partners partnerId operations linkage metrics route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1406
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/metrics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/metrics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

619. GET /api/partners/:partnerId/operations-linkage/parties

• Purpose: GET /api/partners/:partnerId/operations-linkage/parties handled by operationsLinkage.ts; partners partnerId operations linkage parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1886
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

620. POST /api/partners/:partnerId/operations-linkage/parties

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties handled by operationsLinkage.ts; partners partnerId operations linkage parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1953
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

621. GET /api/partners/:partnerId/operations-linkage/parties/:partyId

• Purpose: GET /api/partners/:partnerId/operations-linkage/parties/:partyId handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1949
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

622. POST /api/partners/:partnerId/operations-linkage/parties/:partyId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties/:partyId/actions handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2109
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

623. POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2162
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

624. POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId system links systemLinkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2218
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId, systemLinkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

625. GET /api/partners/:partnerId/operations-linkage/places

• Purpose: GET /api/partners/:partnerId/operations-linkage/places handled by operationsLinkage.ts; partners partnerId operations linkage places route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1887
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

626. POST /api/partners/:partnerId/operations-linkage/places

• Purpose: POST /api/partners/:partnerId/operations-linkage/places handled by operationsLinkage.ts; partners partnerId operations linkage places route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1989
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

627. GET /api/partners/:partnerId/operations-linkage/places/:placeId

• Purpose: GET /api/partners/:partnerId/operations-linkage/places/:placeId handled by operationsLinkage.ts; partners partnerId operations linkage places placeId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1950
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

628. POST /api/partners/:partnerId/operations-linkage/places/:placeId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/places/:placeId/actions handled by operationsLinkage.ts; partners partnerId operations linkage places placeId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2110
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

629. POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage places placeId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2163
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

630. POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage places placeId system links systemLinkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:2219
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId, systemLinkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

631. GET /api/partners/:partnerId/operations-linkage/procurement

• Purpose: GET /api/partners/:partnerId/operations-linkage/procurement handled by operationsLinkage.ts; partners partnerId operations linkage procurement route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3096
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/procurement" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/procurement", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

632. POST /api/partners/:partnerId/operations-linkage/procurement

• Purpose: POST /api/partners/:partnerId/operations-linkage/procurement handled by operationsLinkage.ts; partners partnerId operations linkage procurement route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3224
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/procurement" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/procurement", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

633. POST /api/partners/:partnerId/operations-linkage/procurement/:procurementId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/procurement/:procurementId/actions handled by operationsLinkage.ts; partners partnerId operations linkage procurement procurementId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:3284
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, procurementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/procurement/:procurementId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/procurement/:procurementId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

634. GET /api/partners/:partnerId/operations-linkage/receipts

• Purpose: GET /api/partners/:partnerId/operations-linkage/receipts handled by operationsLinkage.ts; partners partnerId operations linkage receipts route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:4100
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/receipts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/receipts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

635. GET /api/partners/:partnerId/operations-linkage/search

• Purpose: GET /api/partners/:partnerId/operations-linkage/search handled by operationsLinkage.ts; partners partnerId operations linkage search route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:4195
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

636. GET /api/partners/:partnerId/operations-linkage/timeline

• Purpose: GET /api/partners/:partnerId/operations-linkage/timeline handled by operationsLinkage.ts; partners partnerId operations linkage timeline route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:4294
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/timeline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/timeline", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

637. GET /api/pawsports

• Purpose: GET /api/pawsports handled by pawsports.ts; pawsports route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:392
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/pawsports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

638. DELETE /api/pawsports/:id

• Purpose: DELETE /api/pawsports/:id handled by pawsports.ts; pawsports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:878
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

639. PATCH /api/pawsports/:id

• Purpose: PATCH /api/pawsports/:id handled by pawsports.ts; pawsports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:808
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/pawsports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

640. POST /api/pawsports/:id/notes

• Purpose: POST /api/pawsports/:id/notes handled by pawsports.ts; pawsports id notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:894
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

641. DELETE /api/pawsports/:id/notes/:noteId

• Purpose: DELETE /api/pawsports/:id/notes/:noteId handled by pawsports.ts; pawsports id notes noteId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:963
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, noteId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id/notes/:noteId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes/:noteId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

642. PATCH /api/pawsports/:id/notes/:noteId

• Purpose: PATCH /api/pawsports/:id/notes/:noteId handled by pawsports.ts; pawsports id notes noteId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:929
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, noteId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/pawsports/:id/notes/:noteId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes/:noteId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

643. POST /api/pawsports/:id/reassign

• Purpose: POST /api/pawsports/:id/reassign handled by pawsports.ts; pawsports id reassign route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1054
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/reassign" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/reassign", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

644. POST /api/pawsports/:id/reissue

• Purpose: POST /api/pawsports/:id/reissue handled by pawsports.ts; pawsports id reissue route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:633
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/reissue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/reissue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

645. POST /api/pawsports/:id/restore

• Purpose: POST /api/pawsports/:id/restore handled by pawsports.ts; pawsports id restore route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:981
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/restore" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/restore", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

646. POST /api/pawsports/:id/revoke

• Purpose: POST /api/pawsports/:id/revoke handled by pawsports.ts; pawsports id revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:600
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

647. POST /api/pawsports/:id/stamps

• Purpose: POST /api/pawsports/:id/stamps handled by pawsports.ts; pawsports id stamps route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:752
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/stamps" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/stamps", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

648. DELETE /api/pawsports/:id/stamps/:stampId

• Purpose: DELETE /api/pawsports/:id/stamps/:stampId handled by pawsports.ts; pawsports id stamps stampId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:790
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, stampId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id/stamps/:stampId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/stamps/:stampId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

649. POST /api/pawsports/:id/unbind

• Purpose: POST /api/pawsports/:id/unbind handled by pawsports.ts; pawsports id unbind route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1022
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/unbind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/unbind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

650. GET /api/pawsports/attendees/lookup

• Purpose: GET /api/pawsports/attendees/lookup handled by pawsports.ts; pawsports attendees lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:357
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/pawsports/attendees/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/attendees/lookup", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

651. POST /api/pawsports/bind

• Purpose: POST /api/pawsports/bind handled by pawsports.ts; pawsports bind route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:596
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/bind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/bind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

652. POST /api/pawsports/issue

• Purpose: POST /api/pawsports/issue handled by pawsports.ts; pawsports issue route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:481
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/issue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/issue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

653. GET /api/planning/artifacts/:artifactId/content

• Purpose: GET /api/planning/artifacts/:artifactId/content handled by planning.ts; planning artifacts artifactId content route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2543
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/artifacts/:artifactId/content" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/artifacts/:artifactId/content", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

654. GET /api/planning/meta

• Purpose: GET /api/planning/meta handled by planning.ts; planning meta route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:945
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/meta" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/meta", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

655. GET /api/planning/my-work

• Purpose: GET /api/planning/my-work handled by planning.ts; planning my work route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1058
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/my-work" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/my-work", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

656. GET /api/planning/openapi.json

• Purpose: GET /api/planning/openapi.json handled by planning.ts; planning openapi.json route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:109
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/openapi.json" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/openapi.json", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

657. GET /api/planning/projects

• Purpose: GET /api/planning/projects handled by planning.ts; planning projects route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:954
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

658. POST /api/planning/projects

• Purpose: POST /api/planning/projects handled by planning.ts; planning projects route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:986
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

659. GET /api/planning/projects/:projectId

• Purpose: GET /api/planning/projects/:projectId handled by planning.ts; planning projects projectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1425
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

660. PATCH /api/planning/projects/:projectId

• Purpose: PATCH /api/planning/projects/:projectId handled by planning.ts; planning projects projectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1694
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

661. POST /api/planning/projects/:projectId/:collection

• Purpose: POST /api/planning/projects/:projectId/:collection handled by planning.ts; planning projects projectId collection route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3229
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/:collection" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/:collection", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

662. DELETE /api/planning/projects/:projectId/:collection/:resourceId

• Purpose: DELETE /api/planning/projects/:projectId/:collection/:resourceId handled by planning.ts; planning projects projectId collection resourceId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3343
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection, resourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/:collection/:resourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/:collection/:resourceId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

663. PATCH /api/planning/projects/:projectId/:collection/:resourceId

• Purpose: PATCH /api/planning/projects/:projectId/:collection/:resourceId handled by planning.ts; planning projects projectId collection resourceId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3276
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection, resourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId/:collection/:resourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/:collection/:resourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

664. POST /api/planning/projects/:projectId/agenda-templates

• Purpose: POST /api/planning/projects/:projectId/agenda-templates handled by planning.ts; planning projects projectId agenda templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3027
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/agenda-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/agenda-templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

665. POST /api/planning/projects/:projectId/artifacts

• Purpose: POST /api/planning/projects/:projectId/artifacts handled by planning.ts; planning projects projectId artifacts route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2476
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

666. PATCH /api/planning/projects/:projectId/artifacts/:artifactId/controls

• Purpose: PATCH /api/planning/projects/:projectId/artifacts/:artifactId/controls handled by planning.ts; planning projects projectId artifacts artifactId controls route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2597
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/controls" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/controls", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

667. POST /api/planning/projects/:projectId/artifacts/:artifactId/review

• Purpose: POST /api/planning/projects/:projectId/artifacts/:artifactId/review handled by planning.ts; planning projects projectId artifacts artifactId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2579
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

668. POST /api/planning/projects/:projectId/artifacts/:artifactId/versions

• Purpose: POST /api/planning/projects/:projectId/artifacts/:artifactId/versions handled by planning.ts; planning projects projectId artifacts artifactId versions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2524
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/versions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/versions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

669. GET /api/planning/projects/:projectId/audit

• Purpose: GET /api/planning/projects/:projectId/audit handled by planning.ts; planning projects projectId audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3115
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

670. POST /api/planning/projects/:projectId/baselines

• Purpose: POST /api/planning/projects/:projectId/baselines handled by planning.ts; planning projects projectId baselines route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1996
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/baselines" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/baselines", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

671. GET /api/planning/projects/:projectId/bootstrap

• Purpose: GET /api/planning/projects/:projectId/bootstrap handled by planning.ts; planning projects projectId bootstrap route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1217
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/bootstrap" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/bootstrap", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

672. GET /api/planning/projects/:projectId/calendar.ics

• Purpose: GET /api/planning/projects/:projectId/calendar.ics handled by planning.ts; planning projects projectId calendar.ics route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1588
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/calendar.ics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/calendar.ics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

673. GET /api/planning/projects/:projectId/calendar.jscalendar

• Purpose: GET /api/planning/projects/:projectId/calendar.jscalendar handled by planning.ts; planning projects projectId calendar.jscalendar route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1653
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/calendar.jscalendar" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/calendar.jscalendar", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

674. POST /api/planning/projects/:projectId/canonical-command

• Purpose: POST /api/planning/projects/:projectId/canonical-command handled by planning.ts; planning projects projectId canonical command route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2392
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/canonical-command" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/canonical-command", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

675. GET /api/planning/projects/:projectId/change-sets

• Purpose: GET /api/planning/projects/:projectId/change-sets handled by planning.ts; planning projects projectId change sets route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2278
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/change-sets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

676. POST /api/planning/projects/:projectId/change-sets

• Purpose: POST /api/planning/projects/:projectId/change-sets handled by planning.ts; planning projects projectId change sets route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2294
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

677. POST /api/planning/projects/:projectId/change-sets/:changeSetId/apply

• Purpose: POST /api/planning/projects/:projectId/change-sets/:changeSetId/apply handled by planning.ts; planning projects projectId change sets changeSetId apply route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2385
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, changeSetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets/:changeSetId/apply" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets/:changeSetId/apply", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

678. POST /api/planning/projects/:projectId/change-sets/:changeSetId/review

• Purpose: POST /api/planning/projects/:projectId/change-sets/:changeSetId/review handled by planning.ts; planning projects projectId change sets changeSetId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2348
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, changeSetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets/:changeSetId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets/:changeSetId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

679. POST /api/planning/projects/:projectId/comments

• Purpose: POST /api/planning/projects/:projectId/comments handled by planning.ts; planning projects projectId comments route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3126
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/comments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/comments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

680. PUT /api/planning/projects/:projectId/comments/:commentId/reactions/:reaction

• Purpose: PUT /api/planning/projects/:projectId/comments/:commentId/reactions/:reaction handled by planning.ts; planning projects projectId comments commentId reactions reaction route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3151
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, commentId, reaction
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

681. GET /api/planning/projects/:projectId/decision-participants

• Purpose: GET /api/planning/projects/:projectId/decision-participants handled by planning.ts; planning projects projectId decision participants route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2807
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/decision-participants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/decision-participants", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

682. GET /api/planning/projects/:projectId/delivery-history

• Purpose: GET /api/planning/projects/:projectId/delivery-history handled by planningReminderChannels.ts; planning projects projectId delivery history route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:786
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/delivery-history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/delivery-history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

683. DELETE /api/planning/projects/:projectId/departments/:departmentId

• Purpose: DELETE /api/planning/projects/:projectId/departments/:departmentId handled by planning.ts; planning projects projectId departments departmentId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2945
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, departmentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/departments/:departmentId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/departments/:departmentId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

684. POST /api/planning/projects/:projectId/departments/:departmentId/memberships

• Purpose: POST /api/planning/projects/:projectId/departments/:departmentId/memberships handled by planning.ts; planning projects projectId departments departmentId memberships route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2864
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, departmentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/departments/:departmentId/memberships" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/departments/:departmentId/memberships", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

685. DELETE /api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId

• Purpose: DELETE /api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId handled by planning.ts; planning projects projectId departments departmentId memberships membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2925
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, departmentId, membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

686. PATCH /api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId

• Purpose: PATCH /api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId handled by planning.ts; planning projects projectId departments departmentId memberships membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2893
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, departmentId, membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/departments/:departmentId/memberships/:membershipId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

687. POST /api/planning/projects/:projectId/dependencies

• Purpose: POST /api/planning/projects/:projectId/dependencies handled by planning.ts; planning projects projectId dependencies route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1849
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/dependencies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/dependencies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

688. DELETE /api/planning/projects/:projectId/dependencies/:dependencyId

• Purpose: DELETE /api/planning/projects/:projectId/dependencies/:dependencyId handled by planning.ts; planning projects projectId dependencies dependencyId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2028
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, dependencyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/dependencies/:dependencyId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/dependencies/:dependencyId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

689. POST /api/planning/projects/:projectId/destinations

• Purpose: POST /api/planning/projects/:projectId/destinations handled by planning.ts; planning projects projectId destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2420
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

690. POST /api/planning/projects/:projectId/destinations/:destinationId/rotate

• Purpose: POST /api/planning/projects/:projectId/destinations/:destinationId/rotate handled by planning.ts; planning projects projectId destinations destinationId rotate route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3004
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, destinationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations/:destinationId/rotate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations/:destinationId/rotate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

691. POST /api/planning/projects/:projectId/destinations/:destinationId/test

• Purpose: POST /api/planning/projects/:projectId/destinations/:destinationId/test handled by planning.ts; planning projects projectId destinations destinationId test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2459
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, destinationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations/:destinationId/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations/:destinationId/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

692. GET /api/planning/projects/:projectId/event-catalog

• Purpose: GET /api/planning/projects/:projectId/event-catalog handled by planning.ts; planning projects projectId event catalog route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1739
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/event-catalog" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/event-catalog", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

693. POST /api/planning/projects/:projectId/exercises

• Purpose: POST /api/planning/projects/:projectId/exercises handled by planning.ts; planning projects projectId exercises route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3047
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/exercises" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/exercises", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

694. POST /api/planning/projects/:projectId/gates/:gateId/decisions

• Purpose: POST /api/planning/projects/:projectId/gates/:gateId/decisions handled by planning.ts; planning projects projectId gates gateId decisions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3075
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, gateId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/gates/:gateId/decisions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/gates/:gateId/decisions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

695. POST /api/planning/projects/:projectId/handoffs

• Purpose: POST /api/planning/projects/:projectId/handoffs handled by planning.ts; planning projects projectId handoffs route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3093
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/handoffs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/handoffs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

696. GET /api/planning/projects/:projectId/handoffs/:handoffId/export

• Purpose: GET /api/planning/projects/:projectId/handoffs/:handoffId/export handled by planning.ts; planning projects projectId handoffs handoffId export route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3109
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, handoffId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/handoffs/:handoffId/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/handoffs/:handoffId/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

697. POST /api/planning/projects/:projectId/imports

• Purpose: POST /api/planning/projects/:projectId/imports handled by planning.ts; planning projects projectId imports route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3203
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/imports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/imports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

698. POST /api/planning/projects/:projectId/link-event

• Purpose: POST /api/planning/projects/:projectId/link-event handled by planning.ts; planning projects projectId link event route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1719
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/link-event" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/link-event", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

699. GET /api/planning/projects/:projectId/meetings/:meetingId

• Purpose: GET /api/planning/projects/:projectId/meetings/:meetingId handled by planning.ts; planning projects projectId meetings meetingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1674
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

700. POST /api/planning/projects/:projectId/meetings/:meetingId/agenda

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/agenda handled by planning.ts; planning projects projectId meetings meetingId agenda route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2139
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/agenda" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/agenda", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

701. POST /api/planning/projects/:projectId/meetings/:meetingId/agenda/state

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/agenda/state handled by planning.ts; planning projects projectId meetings meetingId agenda state route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2166
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/agenda/state" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/agenda/state", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

702. POST /api/planning/projects/:projectId/meetings/:meetingId/minutes

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/minutes handled by planning.ts; planning projects projectId meetings meetingId minutes route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2172
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/minutes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/minutes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

703. POST /api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions handled by planning.ts; planning projects projectId meetings meetingId minutes with actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2199
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

704. POST /api/planning/projects/:projectId/meetings/:meetingId/notes

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/notes handled by planning.ts; planning projects projectId meetings meetingId notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3167
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

705. PUT /api/planning/projects/:projectId/meetings/:meetingId/rsvp

• Purpose: PUT /api/planning/projects/:projectId/meetings/:meetingId/rsvp handled by planning.ts; planning projects projectId meetings meetingId rsvp route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3158
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/rsvp" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/rsvp", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

706. GET /api/planning/projects/:projectId/member-directory

• Purpose: GET /api/planning/projects/:projectId/member-directory handled by planning.ts; planning projects projectId member directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2768
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/member-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/member-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

707. GET /api/planning/projects/:projectId/my-reminder-channels

• Purpose: GET /api/planning/projects/:projectId/my-reminder-channels handled by planningReminderChannels.ts; planning projects projectId my reminder channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:296
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

708. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/start

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/start handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm start route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:454
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

709. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:457
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

710. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:477
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

711. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:455
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

712. POST /api/planning/projects/:projectId/my-reminder-channels/sms/opt-out

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/opt-out handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms opt out route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:755
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

713. POST /api/planning/projects/:projectId/my-reminder-channels/sms/resend

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/resend handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms resend route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:661
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/resend" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/resend", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

714. POST /api/planning/projects/:projectId/my-reminder-channels/sms/start-verification

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/start-verification handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms start verification route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:656
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

715. POST /api/planning/projects/:projectId/my-reminder-channels/sms/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:744
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

716. POST /api/planning/projects/:projectId/my-reminder-channels/sms/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:765
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

717. POST /api/planning/projects/:projectId/my-reminder-channels/sms/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:679
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

718. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm start route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:330
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

719. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:384
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

720. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:404
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

721. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:375
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

722. POST /api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile

• Purpose: POST /api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile handled by planningReminderChannels.ts; planning projects projectId notification outbox outboxId reconcile route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:815
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, outboxId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

723. POST /api/planning/projects/:projectId/notification-outbox/:outboxId/retry

• Purpose: POST /api/planning/projects/:projectId/notification-outbox/:outboxId/retry handled by planningReminderChannels.ts; planning projects projectId notification outbox outboxId retry route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:800
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, outboxId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-outbox/:outboxId/retry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-outbox/:outboxId/retry", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

724. PUT /api/planning/projects/:projectId/notification-preferences

• Purpose: PUT /api/planning/projects/:projectId/notification-preferences handled by planning.ts; planning projects projectId notification preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3178
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/notification-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-preferences", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

725. POST /api/planning/projects/:projectId/notification-rules

• Purpose: POST /api/planning/projects/:projectId/notification-rules handled by planning.ts; planning projects projectId notification rules route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2014
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-rules" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-rules", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

726. GET /api/planning/projects/:projectId/pages/:collection

• Purpose: GET /api/planning/projects/:projectId/pages/:collection handled by planning.ts; planning projects projectId pages collection route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1258
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/pages/:collection" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/pages/:collection", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

727. POST /api/planning/projects/:projectId/requirement-packs/instantiate

• Purpose: POST /api/planning/projects/:projectId/requirement-packs/instantiate handled by planning.ts; planning projects projectId requirement packs instantiate route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2972
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirement-packs/instantiate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirement-packs/instantiate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

728. POST /api/planning/projects/:projectId/requirement-templates

• Purpose: POST /api/planning/projects/:projectId/requirement-templates handled by planning.ts; planning projects projectId requirement templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2962
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirement-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirement-templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

729. PUT /api/planning/projects/:projectId/requirements/:requirementId/approval-flow

• Purpose: PUT /api/planning/projects/:projectId/requirements/:requirementId/approval-flow handled by planning.ts; planning projects projectId requirements requirementId approval flow route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2688
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/approval-flow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/approval-flow", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

730. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions handled by planning.ts; planning projects projectId requirements requirementId submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2082
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

731. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review handled by planning.ts; planning projects projectId requirements requirementId submissions submissionId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2631
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

732. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw handled by planning.ts; planning projects projectId requirements requirementId submissions submissionId withdraw route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2131
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

733. GET /api/planning/projects/:projectId/requirements/:requirementId/work-items

• Purpose: GET /api/planning/projects/:projectId/requirements/:requirementId/work-items handled by planning.ts; planning projects projectId requirements requirementId work items route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2042
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/work-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/work-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

734. POST /api/planning/projects/:projectId/requirements/:requirementId/work-items

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/work-items handled by planning.ts; planning projects projectId requirements requirementId work items route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2058
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/work-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/work-items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

735. POST /api/planning/projects/:projectId/resource-links

• Purpose: POST /api/planning/projects/:projectId/resource-links handled by planning.ts; planning projects projectId resource links route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1798
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/resource-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/resource-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

736. DELETE /api/planning/projects/:projectId/resource-links/:linkId

• Purpose: DELETE /api/planning/projects/:projectId/resource-links/:linkId handled by planning.ts; planning projects projectId resource links linkId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1834
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/resource-links/:linkId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/resource-links/:linkId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

737. POST /api/planning/projects/:projectId/risks/:riskId/lifecycle

• Purpose: POST /api/planning/projects/:projectId/risks/:riskId/lifecycle handled by planning.ts; planning projects projectId risks riskId lifecycle route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2731
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, riskId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/risks/:riskId/lifecycle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/risks/:riskId/lifecycle", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

738. POST /api/planning/projects/:projectId/saved-views

• Purpose: POST /api/planning/projects/:projectId/saved-views handled by planning.ts; planning projects projectId saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3192
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/saved-views", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

739. DELETE /api/planning/projects/:projectId/saved-views/:viewId

• Purpose: DELETE /api/planning/projects/:projectId/saved-views/:viewId handled by planning.ts; planning projects projectId saved views viewId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3198
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, viewId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/saved-views/:viewId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/saved-views/:viewId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

740. GET /api/planning/projects/:projectId/schedule-window

• Purpose: GET /api/planning/projects/:projectId/schedule-window handled by planning.ts; planning projects projectId schedule window route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1346
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/schedule-window" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/schedule-window", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

741. POST /api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token

• Purpose: POST /api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token handled by planningReminderChannels.ts; planning projects projectId sms gateway devices deviceId native token route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:825
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

742. GET /api/planning/projects/:projectId/usernames/search

• Purpose: GET /api/planning/projects/:projectId/usernames/search handled by planning.ts; planning projects projectId usernames search route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2831
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/usernames/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/usernames/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

743. PUT /api/planning/projects/:projectId/watchers

• Purpose: PUT /api/planning/projects/:projectId/watchers handled by planning.ts; planning projects projectId watchers route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3142
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/watchers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/watchers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

744. POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule handled by planning.ts; planning projects projectId work items workItemId reschedule route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1895
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/reschedule" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/reschedule", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

745. POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview handled by planning.ts; planning projects projectId work items workItemId reschedule preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1935
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

746. POST /api/planning/projects/:projectId/work-items/:workItemId/wbs-position

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/wbs-position handled by planning.ts; planning projects projectId work items workItemId wbs position route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1960
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/wbs-position" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/wbs-position", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

747. GET /api/planning/projects/:projectId/workload-window

• Purpose: GET /api/planning/projects/:projectId/workload-window handled by planning.ts; planning projects projectId workload window route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1381
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/workload-window" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/workload-window", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

748. POST /api/planning/sms-gateway/devices/:deviceId/heartbeat

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/heartbeat handled by planningReminderChannels.ts; planning sms gateway devices deviceId heartbeat route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:922
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/heartbeat" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/heartbeat", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

749. POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt handled by planningReminderChannels.ts; planning sms gateway devices deviceId jobs jobId receipt route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:1087
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId, jobId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

750. POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck handled by planningReminderChannels.ts; planning sms gateway devices deviceId jobs jobId recheck route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:1037
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId, jobId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

751. POST /api/planning/sms-gateway/devices/:deviceId/lease

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/lease handled by planningReminderChannels.ts; planning sms gateway devices deviceId lease route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:946
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/lease" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/lease", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

752. GET /api/planning/sms-gateway/devices/:deviceId/preflight

• Purpose: GET /api/planning/sms-gateway/devices/:deviceId/preflight handled by planningReminderChannels.ts; planning sms gateway devices deviceId preflight route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:906
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/preflight" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/preflight", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

753. POST /api/platform/waitlist

• Purpose: POST /api/platform/waitlist handled by platformWaitlist.ts; platform waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/platformWaitlist.ts:108
• Mounted prefix: /api
• Route module: platformWaitlist.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/platform/waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/platform/waitlist", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

754. POST /api/platform/waitlist

• Purpose: POST /api/platform/waitlist handled by platformWaitlist.ts; platform waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/platformWaitlist.ts:108
• Mounted prefix: /api
• Route module: platformWaitlist.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/platform/waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/platform/waitlist", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

755. GET /api/rego/events/:slug/feedback

• Purpose: GET /api/rego/events/:slug/feedback handled by eventFeedback.ts; rego events slug feedback route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:240
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/feedback" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/feedback", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

756. POST /api/rego/events/:slug/feedback/submissions

• Purpose: POST /api/rego/events/:slug/feedback/submissions handled by eventFeedback.ts; rego events slug feedback submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:277
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/feedback/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/feedback/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

757. GET /api/rego/pawsport

• Purpose: GET /api/rego/pawsport handled by pawsports.ts; rego pawsport route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1280
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/pawsport" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

758. POST /api/rego/pawsport/:id/lost

• Purpose: POST /api/rego/pawsport/:id/lost handled by pawsports.ts; rego pawsport id lost route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1230
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/pawsport/:id/lost" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport/:id/lost", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

759. POST /api/rego/pawsport/enroll

• Purpose: POST /api/rego/pawsport/enroll handled by pawsports.ts; rego pawsport enroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1134
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/pawsport/enroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport/enroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

760. DELETE /api/rego/social/identity-link

• Purpose: DELETE /api/rego/social/identity-link handled by socialIdentityLink.ts; rego social identity link route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:159
• Mounted prefix: /api/rego
• Route module: socialIdentityLink.ts
• Router variable: regoSocialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/social/identity-link" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/identity-link", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

761. GET /api/rego/social/identity-link

• Purpose: GET /api/rego/social/identity-link handled by socialIdentityLink.ts; rego social identity link route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:120
• Mounted prefix: /api/rego
• Route module: socialIdentityLink.ts
• Router variable: regoSocialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/identity-link" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/identity-link", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

762. POST /api/rego/social/identity-link/redeem

• Purpose: POST /api/rego/social/identity-link/redeem handled by socialIdentityLink.ts; rego social identity link redeem route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:128
• Mounted prefix: /api/rego
• Route module: socialIdentityLink.ts
• Router variable: regoSocialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/social/identity-link/redeem" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/identity-link/redeem", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

763. GET /api/social-publishing/oauth/:network/callback

• Purpose: GET /api/social-publishing/oauth/:network/callback handled by socialPublishing.ts; social publishing oauth network callback route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:180
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: network
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social-publishing/oauth/:network/callback" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/oauth/:network/callback", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

764. POST /api/social-publishing/partners/:partnerId/accounts/:network/oauth/start

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/:network/oauth/start handled by socialPublishing.ts; social publishing partners partnerId accounts network oauth start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:153
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, network
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

765. POST /api/social-publishing/partners/:partnerId/accounts/discord-webhook

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/discord-webhook handled by socialPublishing.ts; social publishing partners partnerId accounts discord webhook route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:260
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/discord-webhook" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/discord-webhook", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

766. POST /api/social-publishing/partners/:partnerId/accounts/telegram

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/telegram handled by socialPublishing.ts; social publishing partners partnerId accounts telegram route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:283
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/telegram" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/telegram", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

767. GET /api/social-publishing/partners/:partnerId/overview

• Purpose: GET /api/social-publishing/partners/:partnerId/overview handled by socialPublishing.ts; social publishing partners partnerId overview route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:226
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social-publishing/partners/:partnerId/overview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/overview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

768. POST /api/social-publishing/partners/:partnerId/posts

• Purpose: POST /api/social-publishing/partners/:partnerId/posts handled by socialPublishing.ts; social publishing partners partnerId posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:304
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/posts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

769. POST /api/social-publishing/partners/:partnerId/posts/:postId/queue

• Purpose: POST /api/social-publishing/partners/:partnerId/posts/:postId/queue handled by socialPublishing.ts; social publishing partners partnerId posts postId queue route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:397
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/posts/:postId/queue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/posts/:postId/queue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

770. POST /api/social/account/deactivate

• Purpose: POST /api/social/account/deactivate handled by socialNetwork.ts; social account deactivate route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:751
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/account/deactivate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/account/deactivate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

771. GET /api/social/account/export

• Purpose: GET /api/social/account/export handled by socialNetwork.ts; social account export route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:726
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/account/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/account/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

772. POST /api/social/advertising/campaigns/:campaignId/hide

• Purpose: POST /api/social/advertising/campaigns/:campaignId/hide handled by socialNetwork.ts; social advertising campaigns campaignId hide route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1681
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: campaignId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/advertising/campaigns/:campaignId/hide" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/advertising/campaigns/:campaignId/hide", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

773. POST /api/social/advertising/campaigns/:campaignId/report

• Purpose: POST /api/social/advertising/campaigns/:campaignId/report handled by socialNetwork.ts; social advertising campaigns campaignId report route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1703
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: campaignId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/advertising/campaigns/:campaignId/report" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/advertising/campaigns/:campaignId/report", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

774. POST /api/social/advertising/signals

• Purpose: POST /api/social/advertising/signals handled by socialNetwork.ts; social advertising signals route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:134
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/advertising/signals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/advertising/signals", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

775. GET /api/social/channels

• Purpose: GET /api/social/channels handled by socialNetwork.ts; social channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1437
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/channels", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

776. POST /api/social/channels

• Purpose: POST /api/social/channels handled by socialNetwork.ts; social channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1546
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/channels", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

777. PUT /api/social/channels/:slug/membership

• Purpose: PUT /api/social/channels/:slug/membership handled by socialNetwork.ts; social channels slug membership route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1593
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/channels/:slug/membership" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/channels/:slug/membership", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

778. GET /api/social/channels/:slug/posts

• Purpose: GET /api/social/channels/:slug/posts handled by socialNetwork.ts; social channels slug posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1626
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/channels/:slug/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/channels/:slug/posts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

779. GET /api/social/custom-emojis

• Purpose: GET /api/social/custom-emojis handled by socialNetwork.ts; social custom emojis route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1461
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/custom-emojis" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/custom-emojis", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

780. POST /api/social/custom-emojis

• Purpose: POST /api/social/custom-emojis handled by socialNetwork.ts; social custom emojis route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1481
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/custom-emojis" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/custom-emojis", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

781. PATCH /api/social/custom-emojis/:shortcode

• Purpose: PATCH /api/social/custom-emojis/:shortcode handled by socialNetwork.ts; social custom emojis shortcode route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1523
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: shortcode
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/custom-emojis/:shortcode" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/custom-emojis/:shortcode", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

782. DELETE /api/social/discovery/preferences

• Purpose: DELETE /api/social/discovery/preferences handled by socialNetwork.ts; social discovery preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3087
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/discovery/preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/discovery/preferences", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

783. GET /api/social/discovery/preferences

• Purpose: GET /api/social/discovery/preferences handled by socialNetwork.ts; social discovery preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3057
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/discovery/preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/discovery/preferences", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

784. PUT /api/social/discovery/preferences

• Purpose: PUT /api/social/discovery/preferences handled by socialNetwork.ts; social discovery preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3068
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/discovery/preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/discovery/preferences", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

785. GET /api/social/event-disclosure

• Purpose: GET /api/social/event-disclosure handled by socialNetwork.ts; social event disclosure route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2469
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/event-disclosure" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/event-disclosure", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

786. PUT /api/social/event-disclosure

• Purpose: PUT /api/social/event-disclosure handled by socialNetwork.ts; social event disclosure route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2488
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/event-disclosure" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/event-disclosure", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

787. PUT /api/social/event-discovery/:eventId

• Purpose: PUT /api/social/event-discovery/:eventId handled by socialNetwork.ts; social event discovery eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3353
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/event-discovery/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/event-discovery/:eventId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

788. POST /api/social/event-page-verifications/:requestId/decisions

• Purpose: POST /api/social/event-page-verifications/:requestId/decisions handled by socialNetwork.ts; social event page verifications requestId decisions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4473
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/event-page-verifications/:requestId/decisions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/event-page-verifications/:requestId/decisions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

789. GET /api/social/events/:eventId/event-page-verification

• Purpose: GET /api/social/events/:eventId/event-page-verification handled by socialNetwork.ts; social events eventId event page verification route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4419
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/events/:eventId/event-page-verification" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/event-page-verification", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

790. POST /api/social/events/:eventId/event-page-verifications/:requestId/admin-handoff

• Purpose: POST /api/social/events/:eventId/event-page-verifications/:requestId/admin-handoff handled by socialNetwork.ts; social events eventId event page verifications requestId admin handoff route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4521
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/events/:eventId/event-page-verifications/:requestId/admin-handoff" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/event-page-verifications/:requestId/admin-handoff", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

791. DELETE /api/social/events/:eventId/rsvp

• Purpose: DELETE /api/social/events/:eventId/rsvp handled by socialNetwork.ts; social events eventId rsvp route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3239
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/events/:eventId/rsvp" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/rsvp", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

792. PUT /api/social/events/:eventId/rsvp

• Purpose: PUT /api/social/events/:eventId/rsvp handled by socialNetwork.ts; social events eventId rsvp route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3218
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/events/:eventId/rsvp" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/rsvp", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

793. DELETE /api/social/events/:eventId/saved

• Purpose: DELETE /api/social/events/:eventId/saved handled by socialNetwork.ts; social events eventId saved route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3191
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/events/:eventId/saved" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/saved", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

794. PUT /api/social/events/:eventId/saved

• Purpose: PUT /api/social/events/:eventId/saved handled by socialNetwork.ts; social events eventId saved route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3178
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/events/:eventId/saved" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/:eventId/saved", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

795. GET /api/social/events/rsvps

• Purpose: GET /api/social/events/rsvps handled by socialNetwork.ts; social events rsvps route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3206
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/events/rsvps" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/rsvps", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

796. GET /api/social/events/saved

• Purpose: GET /api/social/events/saved handled by socialNetwork.ts; social events saved route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3100
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/events/saved" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/events/saved", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

797. DELETE /api/social/identity-link

• Purpose: DELETE /api/social/identity-link handled by socialIdentityLink.ts; social identity link route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:104
• Mounted prefix: /api/social
• Route module: socialIdentityLink.ts
• Router variable: socialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/identity-link" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/identity-link", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

798. GET /api/social/identity-link

• Purpose: GET /api/social/identity-link handled by socialIdentityLink.ts; social identity link route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:58
• Mounted prefix: /api/social
• Route module: socialIdentityLink.ts
• Router variable: socialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/identity-link" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/identity-link", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

799. POST /api/social/identity-link/challenges

• Purpose: POST /api/social/identity-link/challenges handled by socialIdentityLink.ts; social identity link challenges route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialIdentityLink.ts:73
• Mounted prefix: /api/social
• Route module: socialIdentityLink.ts
• Router variable: socialIdentityLinkRoutes
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/identity-link/challenges" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/identity-link/challenges", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

800. POST /api/social/internal/event-discovery

• Purpose: POST /api/social/internal/event-discovery handled by socialNetwork.ts; social internal event discovery route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3377
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/internal/event-discovery" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/internal/event-discovery", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

801. GET /api/social/me/partner-event-links

• Purpose: GET /api/social/me/partner-event-links handled by socialNetwork.ts; social me partner event links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3680
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/me/partner-event-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/me/partner-event-links", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

802. PUT /api/social/me/partner-event-links

• Purpose: PUT /api/social/me/partner-event-links handled by socialNetwork.ts; social me partner event links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3696
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/me/partner-event-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/me/partner-event-links", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

803. GET /api/social/media/:mediaAssetId/content

• Purpose: GET /api/social/media/:mediaAssetId/content handled by socialNetwork.ts; social media mediaAssetId content route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4928
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: mediaAssetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/media/:mediaAssetId/content" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/media/:mediaAssetId/content", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

804. POST /api/social/media/images

• Purpose: POST /api/social/media/images handled by socialNetwork.ts; social media images route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4627
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/media/images" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/media/images", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

805. GET /api/social/media/ready

• Purpose: GET /api/social/media/ready handled by socialNetwork.ts; social media ready route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4906
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/media/ready" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/media/ready", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

806. POST /api/social/media/rich

• Purpose: POST /api/social/media/rich handled by socialNetwork.ts; social media rich route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4787
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/media/rich" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/media/rich", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

807. GET /api/social/meetups/sessions

• Purpose: GET /api/social/meetups/sessions handled by socialMeetup.ts; social meetups sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialMeetup.ts:66
• Mounted prefix: /api/social/meetups
• Route module: socialMeetup.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/meetups/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/meetups/sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

808. DELETE /api/social/meetups/sessions/:id

• Purpose: DELETE /api/social/meetups/sessions/:id handled by socialMeetup.ts; social meetups sessions id route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialMeetup.ts:80
• Mounted prefix: /api/social/meetups
• Route module: socialMeetup.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/meetups/sessions/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/meetups/sessions/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

809. POST /api/social/moderation-appeals

• Purpose: POST /api/social/moderation-appeals handled by socialNetwork.ts; social moderation appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2378
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation-appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation-appeals", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

810. GET /api/social/moderation/access

• Purpose: GET /api/social/moderation/access handled by socialNetwork.ts; social moderation access route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5755
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

811. GET /api/social/moderation/activity

• Purpose: GET /api/social/moderation/activity handled by socialNetwork.ts; social moderation activity route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6610
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/activity" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/activity", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

812. POST /api/social/moderation/activity/:activityId/review

• Purpose: POST /api/social/moderation/activity/:activityId/review handled by socialNetwork.ts; social moderation activity activityId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6644
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: activityId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/activity/:activityId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/activity/:activityId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

813. GET /api/social/moderation/analytics

• Purpose: GET /api/social/moderation/analytics handled by socialNetwork.ts; social moderation analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5953
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

814. GET /api/social/moderation/appeals

• Purpose: GET /api/social/moderation/appeals handled by socialNetwork.ts; social moderation appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7097
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

815. POST /api/social/moderation/appeals/:appealId/actions

• Purpose: POST /api/social/moderation/appeals/:appealId/actions handled by socialNetwork.ts; social moderation appeals appealId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7222
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appealId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/appeals/:appealId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/appeals/:appealId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

816. GET /api/social/moderation/assignees

• Purpose: GET /api/social/moderation/assignees handled by socialNetwork.ts; social moderation assignees route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6784
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/assignees" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/assignees", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

817. GET /api/social/moderation/audit

• Purpose: GET /api/social/moderation/audit handled by socialNetwork.ts; social moderation audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5973
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

818. GET /api/social/moderation/audit/export

• Purpose: GET /api/social/moderation/audit/export handled by socialNetwork.ts; social moderation audit export route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5875
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/audit/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/audit/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

819. GET /api/social/moderation/audit/operations

• Purpose: GET /api/social/moderation/audit/operations handled by socialNetwork.ts; social moderation audit operations route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5922
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/audit/operations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/audit/operations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

820. GET /api/social/moderation/bootstrap

• Purpose: GET /api/social/moderation/bootstrap handled by socialNetwork.ts; social moderation bootstrap route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6484
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/bootstrap" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/bootstrap", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

821. GET /api/social/moderation/cases/:caseId

• Purpose: GET /api/social/moderation/cases/:caseId handled by socialNetwork.ts; social moderation cases caseId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6683
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/cases/:caseId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

822. POST /api/social/moderation/cases/:caseId/actions

• Purpose: POST /api/social/moderation/cases/:caseId/actions handled by socialNetwork.ts; social moderation cases caseId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6897
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

823. POST /api/social/moderation/cases/:caseId/assignment

• Purpose: POST /api/social/moderation/cases/:caseId/assignment handled by socialNetwork.ts; social moderation cases caseId assignment route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6793
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/assignment" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/assignment", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

824. POST /api/social/moderation/cases/:caseId/escalations

• Purpose: POST /api/social/moderation/cases/:caseId/escalations handled by socialNetwork.ts; social moderation cases caseId escalations route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6825
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/escalations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/escalations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

825. POST /api/social/moderation/cases/:caseId/legal-holds

• Purpose: POST /api/social/moderation/cases/:caseId/legal-holds handled by socialNetwork.ts; social moderation cases caseId legal holds route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7114
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/legal-holds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/legal-holds", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

826. POST /api/social/moderation/cases/:caseId/links

• Purpose: POST /api/social/moderation/cases/:caseId/links handled by socialNetwork.ts; social moderation cases caseId links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6883
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

827. POST /api/social/moderation/cases/:caseId/member-notices

• Purpose: POST /api/social/moderation/cases/:caseId/member-notices handled by socialNetwork.ts; social moderation cases caseId member notices route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7039
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/member-notices" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/member-notices", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

828. POST /api/social/moderation/cases/:caseId/notes

• Purpose: POST /api/social/moderation/cases/:caseId/notes handled by socialNetwork.ts; social moderation cases caseId notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7249
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

829. POST /api/social/moderation/cases/:caseId/organization

• Purpose: POST /api/social/moderation/cases/:caseId/organization handled by socialNetwork.ts; social moderation cases caseId organization route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6809
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/organization" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/organization", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

830. POST /api/social/moderation/cases/:caseId/retention-purges

• Purpose: POST /api/social/moderation/cases/:caseId/retention-purges handled by socialNetwork.ts; social moderation cases caseId retention purges route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7186
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/retention-purges" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/retention-purges", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

831. GET /api/social/moderation/cases/:caseId/retention-review

• Purpose: GET /api/social/moderation/cases/:caseId/retention-review handled by socialNetwork.ts; social moderation cases caseId retention review route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7145
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/cases/:caseId/retention-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/retention-review", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

832. POST /api/social/moderation/cases/:caseId/signal-feedback

• Purpose: POST /api/social/moderation/cases/:caseId/signal-feedback handled by socialNetwork.ts; social moderation cases caseId signal feedback route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6764
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/signal-feedback" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/signal-feedback", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

833. POST /api/social/moderation/cases/:caseId/signals/:signalId/acknowledge

• Purpose: POST /api/social/moderation/cases/:caseId/signals/:signalId/acknowledge handled by socialNetwork.ts; social moderation cases caseId signals signalId acknowledge route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6746
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: caseId, signalId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/:caseId/signals/:signalId/acknowledge" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/:caseId/signals/:signalId/acknowledge", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

834. POST /api/social/moderation/cases/bulk-organization

• Purpose: POST /api/social/moderation/cases/bulk-organization handled by socialNetwork.ts; social moderation cases bulk organization route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6865
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/cases/bulk-organization" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/cases/bulk-organization", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

835. GET /api/social/moderation/escalations

• Purpose: GET /api/social/moderation/escalations handled by socialNetwork.ts; social moderation escalations route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6840
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/escalations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/escalations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

836. POST /api/social/moderation/escalations/:escalationId/resolve

• Purpose: POST /api/social/moderation/escalations/:escalationId/resolve handled by socialNetwork.ts; social moderation escalations escalationId resolve route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6848
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: escalationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/escalations/:escalationId/resolve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/escalations/:escalationId/resolve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

837. POST /api/social/moderation/handoffs

• Purpose: POST /api/social/moderation/handoffs handled by socialNetwork.ts; social moderation handoffs route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7274
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/handoffs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/handoffs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

838. POST /api/social/moderation/handoffs/:pointer/redeem

• Purpose: POST /api/social/moderation/handoffs/:pointer/redeem handled by socialNetwork.ts; social moderation handoffs pointer redeem route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7321
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: pointer
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/handoffs/:pointer/redeem" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/handoffs/:pointer/redeem", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

839. POST /api/social/moderation/legal-holds/:holdId/release

• Purpose: POST /api/social/moderation/legal-holds/:holdId/release handled by socialNetwork.ts; social moderation legal holds holdId release route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7128
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: holdId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/legal-holds/:holdId/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/legal-holds/:holdId/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

840. GET /api/social/moderation/link-policies

• Purpose: GET /api/social/moderation/link-policies handled by socialNetwork.ts; social moderation link policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6067
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/link-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/link-policies", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

841. POST /api/social/moderation/link-policies

• Purpose: POST /api/social/moderation/link-policies handled by socialNetwork.ts; social moderation link policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6093
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/link-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/link-policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

842. POST /api/social/moderation/link-policies/:policyId/disable

• Purpose: POST /api/social/moderation/link-policies/:policyId/disable handled by socialNetwork.ts; social moderation link policies policyId disable route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6133
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/link-policies/:policyId/disable" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/link-policies/:policyId/disable", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

843. POST /api/social/moderation/media-hash-policies

• Purpose: POST /api/social/moderation/media-hash-policies handled by socialNetwork.ts; social moderation media hash policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6372
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/media-hash-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/media-hash-policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

844. POST /api/social/moderation/media-hash-policies/:policyId/disable

• Purpose: POST /api/social/moderation/media-hash-policies/:policyId/disable handled by socialNetwork.ts; social moderation media hash policies policyId disable route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6395
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/media-hash-policies/:policyId/disable" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/media-hash-policies/:policyId/disable", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

845. GET /api/social/moderation/media-quarantines

• Purpose: GET /api/social/moderation/media-quarantines handled by socialNetwork.ts; social moderation media quarantines route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6338
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/media-quarantines" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/media-quarantines", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

846. POST /api/social/moderation/media-quarantines/:quarantineId/release

• Purpose: POST /api/social/moderation/media-quarantines/:quarantineId/release handled by socialNetwork.ts; social moderation media quarantines quarantineId release route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6412
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: quarantineId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/media-quarantines/:quarantineId/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/media-quarantines/:quarantineId/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

847. GET /api/social/moderation/note-eligible-staff

• Purpose: GET /api/social/moderation/note-eligible-staff handled by socialNetwork.ts; social moderation note eligible staff route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7264
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/note-eligible-staff" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/note-eligible-staff", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

848. POST /api/social/moderation/quick-page-actions

• Purpose: POST /api/social/moderation/quick-page-actions handled by socialNetwork.ts; social moderation quick page actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7005
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/quick-page-actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/quick-page-actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

849. POST /api/social/moderation/quick-post-actions

• Purpose: POST /api/social/moderation/quick-post-actions handled by socialNetwork.ts; social moderation quick post actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6941
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/quick-post-actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/quick-post-actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

850. POST /api/social/moderation/quick-profile-actions

• Purpose: POST /api/social/moderation/quick-profile-actions handled by socialNetwork.ts; social moderation quick profile actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6972
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/quick-profile-actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/quick-profile-actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

851. GET /api/social/moderation/registration-invites

• Purpose: GET /api/social/moderation/registration-invites handled by socialNetwork.ts; social moderation registration invites route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5768
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/registration-invites" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/registration-invites", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

852. POST /api/social/moderation/registration-invites

• Purpose: POST /api/social/moderation/registration-invites handled by socialNetwork.ts; social moderation registration invites route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5785
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/registration-invites" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/registration-invites", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

853. DELETE /api/social/moderation/registration-invites/:inviteId

• Purpose: DELETE /api/social/moderation/registration-invites/:inviteId handled by socialNetwork.ts; social moderation registration invites inviteId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5810
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: inviteId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/moderation/registration-invites/:inviteId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/registration-invites/:inviteId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

854. GET /api/social/moderation/response-templates

• Purpose: GET /api/social/moderation/response-templates handled by socialNetwork.ts; social moderation response templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7066
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/response-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/response-templates", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

855. POST /api/social/moderation/response-templates

• Purpose: POST /api/social/moderation/response-templates handled by socialNetwork.ts; social moderation response templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7074
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/response-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/response-templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

856. DELETE /api/social/moderation/response-templates/:templateId

• Purpose: DELETE /api/social/moderation/response-templates/:templateId handled by socialNetwork.ts; social moderation response templates templateId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7085
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: templateId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/moderation/response-templates/:templateId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/response-templates/:templateId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

857. POST /api/social/moderation/retention-purges/:requestId/approve

• Purpose: POST /api/social/moderation/retention-purges/:requestId/approve handled by socialNetwork.ts; social moderation retention purges requestId approve route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:7207
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/retention-purges/:requestId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/retention-purges/:requestId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

858. GET /api/social/moderation/rich-media-reviews

• Purpose: GET /api/social/moderation/rich-media-reviews handled by socialNetwork.ts; social moderation rich media reviews route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6429
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/rich-media-reviews" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/rich-media-reviews", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

859. POST /api/social/moderation/rich-media-reviews/:reviewItemId

• Purpose: POST /api/social/moderation/rich-media-reviews/:reviewItemId handled by socialNetwork.ts; social moderation rich media reviews reviewItemId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6456
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: reviewItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/rich-media-reviews/:reviewItemId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/rich-media-reviews/:reviewItemId", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

860. GET /api/social/moderation/staff

• Purpose: GET /api/social/moderation/staff handled by socialNetwork.ts; social moderation staff route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5829
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/staff" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/staff", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

861. DELETE /api/social/moderation/staff/:staffUserId

• Purpose: DELETE /api/social/moderation/staff/:staffUserId handled by socialNetwork.ts; social moderation staff staffUserId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6040
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: staffUserId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/moderation/staff/:staffUserId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/staff/:staffUserId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

862. PUT /api/social/moderation/staff/:staffUserId

• Purpose: PUT /api/social/moderation/staff/:staffUserId handled by socialNetwork.ts; social moderation staff staffUserId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6000
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: staffUserId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/moderation/staff/:staffUserId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/staff/:staffUserId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

863. GET /api/social/moderation/staff/audit

• Purpose: GET /api/social/moderation/staff/audit handled by socialNetwork.ts; social moderation staff audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5852
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/staff/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/staff/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

864. GET /api/social/moderation/text-policies

• Purpose: GET /api/social/moderation/text-policies handled by socialNetwork.ts; social moderation text policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6156
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/text-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

865. POST /api/social/moderation/text-policies

• Purpose: POST /api/social/moderation/text-policies handled by socialNetwork.ts; social moderation text policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6192
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/text-policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

866. POST /api/social/moderation/text-policies/:policyId/disable

• Purpose: POST /api/social/moderation/text-policies/:policyId/disable handled by socialNetwork.ts; social moderation text policies policyId disable route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6220
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/text-policies/:policyId/disable" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies/:policyId/disable", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

867. GET /api/social/moderation/text-policies/:policyId/exceptions

• Purpose: GET /api/social/moderation/text-policies/:policyId/exceptions handled by socialNetwork.ts; social moderation text policies policyId exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6238
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/moderation/text-policies/:policyId/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies/:policyId/exceptions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

868. POST /api/social/moderation/text-policies/:policyId/exceptions

• Purpose: POST /api/social/moderation/text-policies/:policyId/exceptions handled by socialNetwork.ts; social moderation text policies policyId exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6267
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/text-policies/:policyId/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies/:policyId/exceptions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

869. POST /api/social/moderation/text-policies/:policyId/exceptions/:exceptionId/disable

• Purpose: POST /api/social/moderation/text-policies/:policyId/exceptions/:exceptionId/disable handled by socialNetwork.ts; social moderation text policies policyId exceptions exceptionId disable route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6304
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: policyId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/text-policies/:policyId/exceptions/:exceptionId/disable" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies/:policyId/exceptions/:exceptionId/disable", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

870. POST /api/social/moderation/text-policies/simulate

• Purpose: POST /api/social/moderation/text-policies/simulate handled by socialNetwork.ts; social moderation text policies simulate route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:6173
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/moderation/text-policies/simulate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/moderation/text-policies/simulate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

871. GET /api/social/notification-preferences

• Purpose: GET /api/social/notification-preferences handled by socialNetwork.ts; social notification preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2327
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/notification-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/notification-preferences", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

872. PUT /api/social/notification-preferences

• Purpose: PUT /api/social/notification-preferences handled by socialNetwork.ts; social notification preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2343
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/notification-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/notification-preferences", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

873. GET /api/social/notifications

• Purpose: GET /api/social/notifications handled by socialNetwork.ts; social notifications route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2242
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/notifications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/notifications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

874. POST /api/social/notifications/read

• Purpose: POST /api/social/notifications/read handled by socialNetwork.ts; social notifications read route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2278
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/notifications/read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/notifications/read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

875. POST /api/social/page-admin-handoffs/:pointer/redeem

• Purpose: POST /api/social/page-admin-handoffs/:pointer/redeem handled by socialNetwork.ts; social page admin handoffs pointer redeem route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4548
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: pointer
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/page-admin-handoffs/:pointer/redeem" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/page-admin-handoffs/:pointer/redeem", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

876. GET /api/social/page-invitations

• Purpose: GET /api/social/page-invitations handled by socialNetwork.ts; social page invitations route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4593
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/page-invitations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/page-invitations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

877. POST /api/social/page-invitations/:invitationId/accept

• Purpose: POST /api/social/page-invitations/:invitationId/accept handled by socialNetwork.ts; social page invitations invitationId accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4609
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: invitationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/page-invitations/:invitationId/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/page-invitations/:invitationId/accept", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

878. GET /api/social/pages

• Purpose: GET /api/social/pages handled by socialPageDiscovery.ts; social pages route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPageDiscovery.ts:8
• Mounted prefix: /api/social
• Route module: socialPageDiscovery.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

879. POST /api/social/pages

• Purpose: POST /api/social/pages handled by socialNetwork.ts; social pages route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3724
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

880. GET /api/social/pages/:slug

• Purpose: GET /api/social/pages/:slug handled by socialNetwork.ts; social pages slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3751
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

881. PATCH /api/social/pages/:slug

• Purpose: PATCH /api/social/pages/:slug handled by socialNetwork.ts; social pages slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3806
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/pages/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

882. POST /api/social/pages/:slug/announcements

• Purpose: POST /api/social/pages/:slug/announcements handled by socialNetwork.ts; social pages slug announcements route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4030
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/announcements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

883. PUT /api/social/pages/:slug/announcements/:announcementId

• Purpose: PUT /api/social/pages/:slug/announcements/:announcementId handled by socialNetwork.ts; social pages slug announcements announcementId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4052
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, announcementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/pages/:slug/announcements/:announcementId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements/:announcementId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

884. POST /api/social/pages/:slug/announcements/:announcementId/approve

• Purpose: POST /api/social/pages/:slug/announcements/:announcementId/approve handled by socialNetwork.ts; social pages slug announcements announcementId approve route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4099
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, announcementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/announcements/:announcementId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements/:announcementId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

885. POST /api/social/pages/:slug/announcements/:announcementId/publish

• Purpose: POST /api/social/pages/:slug/announcements/:announcementId/publish handled by socialNetwork.ts; social pages slug announcements announcementId publish route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4100
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, announcementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/announcements/:announcementId/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements/:announcementId/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

886. POST /api/social/pages/:slug/announcements/:announcementId/withdraw

• Purpose: POST /api/social/pages/:slug/announcements/:announcementId/withdraw handled by socialNetwork.ts; social pages slug announcements announcementId withdraw route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4101
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, announcementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/announcements/:announcementId/withdraw" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements/:announcementId/withdraw", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

887. GET /api/social/pages/:slug/announcements/workflow

• Purpose: GET /api/social/pages/:slug/announcements/workflow handled by socialNetwork.ts; social pages slug announcements workflow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4019
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/announcements/workflow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/announcements/workflow", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

888. POST /api/social/pages/:slug/archive

• Purpose: POST /api/social/pages/:slug/archive handled by socialNetwork.ts; social pages slug archive route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3853
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/archive" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/archive", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

889. GET /api/social/pages/:slug/drafts

• Purpose: GET /api/social/pages/:slug/drafts handled by socialNetwork.ts; social pages slug drafts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4103
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/drafts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/drafts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

890. POST /api/social/pages/:slug/drafts

• Purpose: POST /api/social/pages/:slug/drafts handled by socialNetwork.ts; social pages slug drafts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4116
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/drafts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/drafts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

891. DELETE /api/social/pages/:slug/drafts/:draftId

• Purpose: DELETE /api/social/pages/:slug/drafts/:draftId handled by socialNetwork.ts; social pages slug drafts draftId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4159
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, draftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/pages/:slug/drafts/:draftId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/drafts/:draftId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

892. PUT /api/social/pages/:slug/drafts/:draftId

• Purpose: PUT /api/social/pages/:slug/drafts/:draftId handled by socialNetwork.ts; social pages slug drafts draftId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4135
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, draftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/pages/:slug/drafts/:draftId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/drafts/:draftId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

893. POST /api/social/pages/:slug/event-verification-requests

• Purpose: POST /api/social/pages/:slug/event-verification-requests handled by socialNetwork.ts; social pages slug event verification requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4377
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/event-verification-requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/event-verification-requests", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

894. DELETE /api/social/pages/:slug/follow

• Purpose: DELETE /api/social/pages/:slug/follow handled by socialNetwork.ts; social pages slug follow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4282
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/pages/:slug/follow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/follow", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

895. GET /api/social/pages/:slug/follow

• Purpose: GET /api/social/pages/:slug/follow handled by socialNetwork.ts; social pages slug follow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4296
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/follow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/follow", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

896. PUT /api/social/pages/:slug/follow

• Purpose: PUT /api/social/pages/:slug/follow handled by socialNetwork.ts; social pages slug follow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4262
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/pages/:slug/follow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/follow", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

897. POST /api/social/pages/:slug/invitations

• Purpose: POST /api/social/pages/:slug/invitations handled by socialNetwork.ts; social pages slug invitations route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4313
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/invitations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/invitations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

898. GET /api/social/pages/:slug/members

• Purpose: GET /api/social/pages/:slug/members handled by socialNetwork.ts; social pages slug members route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4239
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/members" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/members", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

899. DELETE /api/social/pages/:slug/members/:username

• Purpose: DELETE /api/social/pages/:slug/members/:username handled by socialNetwork.ts; social pages slug members username route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4347
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/pages/:slug/members/:username" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/members/:username", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

900. GET /api/social/pages/:slug/notifications

• Purpose: GET /api/social/pages/:slug/notifications handled by socialNetwork.ts; social pages slug notifications route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4194
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/notifications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/notifications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

901. POST /api/social/pages/:slug/notifications/read

• Purpose: POST /api/social/pages/:slug/notifications/read handled by socialNetwork.ts; social pages slug notifications read route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4218
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/notifications/read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/notifications/read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

902. POST /api/social/pages/:slug/ownership/relinquish

• Purpose: POST /api/social/pages/:slug/ownership/relinquish handled by socialNetwork.ts; social pages slug ownership relinquish route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3912
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/ownership/relinquish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/ownership/relinquish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

903. GET /api/social/pages/:slug/partner-event-links

• Purpose: GET /api/social/pages/:slug/partner-event-links handled by socialNetwork.ts; social pages slug partner event links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3643
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/:slug/partner-event-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/partner-event-links", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

904. PUT /api/social/pages/:slug/partner-event-links

• Purpose: PUT /api/social/pages/:slug/partner-event-links handled by socialNetwork.ts; social pages slug partner event links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3654
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/pages/:slug/partner-event-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/partner-event-links", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

905. POST /api/social/pages/:slug/reports

• Purpose: POST /api/social/pages/:slug/reports handled by socialNetwork.ts; social pages slug reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2783
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/reports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

906. POST /api/social/pages/:slug/restore

• Purpose: POST /api/social/pages/:slug/restore handled by socialNetwork.ts; social pages slug restore route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3882
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/pages/:slug/restore" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/:slug/restore", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

907. GET /api/social/pages/mine

• Purpose: GET /api/social/pages/mine handled by socialNetwork.ts; social pages mine route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3531
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/pages/mine" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/pages/mine", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

908. GET /api/social/posts

• Purpose: GET /api/social/posts handled by socialNetwork.ts; social posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1729
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

909. POST /api/social/posts

• Purpose: POST /api/social/posts handled by socialNetwork.ts; social posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5046
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

910. DELETE /api/social/posts/:postId

• Purpose: DELETE /api/social/posts/:postId handled by socialNetwork.ts; social posts postId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5316
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/posts/:postId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

911. PATCH /api/social/posts/:postId

• Purpose: PATCH /api/social/posts/:postId handled by socialNetwork.ts; social posts postId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5235
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/posts/:postId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

912. DELETE /api/social/posts/:postId/bookmark

• Purpose: DELETE /api/social/posts/:postId/bookmark handled by socialNetwork.ts; social posts postId bookmark route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5391
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/posts/:postId/bookmark" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/bookmark", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

913. PUT /api/social/posts/:postId/bookmark

• Purpose: PUT /api/social/posts/:postId/bookmark handled by socialNetwork.ts; social posts postId bookmark route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5377
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/posts/:postId/bookmark" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/bookmark", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

914. DELETE /api/social/posts/:postId/custom-emoji-reactions/:shortcode

• Purpose: DELETE /api/social/posts/:postId/custom-emoji-reactions/:shortcode handled by socialNetwork.ts; social posts postId custom emoji reactions shortcode route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5525
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId, shortcode
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/posts/:postId/custom-emoji-reactions/:shortcode" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/custom-emoji-reactions/:shortcode", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

915. POST /api/social/posts/:postId/media

• Purpose: POST /api/social/posts/:postId/media handled by socialNetwork.ts; social posts postId media route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4987
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/posts/:postId/media" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/media", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

916. POST /api/social/posts/:postId/poll-votes

• Purpose: POST /api/social/posts/:postId/poll-votes handled by socialNetwork.ts; social posts postId poll votes route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5405
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/posts/:postId/poll-votes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/poll-votes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

917. POST /api/social/posts/:postId/reactions

• Purpose: POST /api/social/posts/:postId/reactions handled by socialNetwork.ts; social posts postId reactions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5449
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/posts/:postId/reactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/reactions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

918. DELETE /api/social/posts/:postId/reactions/:reaction

• Purpose: DELETE /api/social/posts/:postId/reactions/:reaction handled by socialNetwork.ts; social posts postId reactions reaction route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5498
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId, reaction
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/posts/:postId/reactions/:reaction" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/reactions/:reaction", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

919. POST /api/social/posts/:postId/reports

• Purpose: POST /api/social/posts/:postId/reports handled by socialNetwork.ts; social posts postId reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5701
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/posts/:postId/reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/reports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

920. DELETE /api/social/posts/:postId/repost

• Purpose: DELETE /api/social/posts/:postId/repost handled by socialNetwork.ts; social posts postId repost route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5363
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/posts/:postId/repost" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/repost", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

921. PUT /api/social/posts/:postId/repost

• Purpose: PUT /api/social/posts/:postId/repost handled by socialNetwork.ts; social posts postId repost route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5343
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/posts/:postId/repost" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/repost", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

922. GET /api/social/posts/:postId/revisions

• Purpose: GET /api/social/posts/:postId/revisions handled by socialNetwork.ts; social posts postId revisions route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5291
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/posts/:postId/revisions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/revisions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

923. GET /api/social/posts/:postId/thread

• Purpose: GET /api/social/posts/:postId/thread handled by socialNetwork.ts; social posts postId thread route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1944
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/posts/:postId/thread" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/:postId/thread", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

924. GET /api/social/posts/following

• Purpose: GET /api/social/posts/following handled by socialNetwork.ts; social posts following route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1841
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/posts/following" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/following", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

925. GET /api/social/posts/friends

• Purpose: GET /api/social/posts/friends handled by socialNetwork.ts; social posts friends route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1910
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/posts/friends" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/posts/friends", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

926. GET /api/social/profiles

• Purpose: GET /api/social/profiles handled by socialNetwork.ts; social profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2984
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

927. GET /api/social/profiles/:username

• Purpose: GET /api/social/profiles/:username handled by socialNetwork.ts; social profiles username route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2627
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/profiles/:username" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/:username", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

928. GET /api/social/profiles/:username/events

• Purpose: GET /api/social/profiles/:username/events handled by socialNetwork.ts; social profiles username events route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2529
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/profiles/:username/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/:username/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

929. DELETE /api/social/profiles/:username/follow

• Purpose: DELETE /api/social/profiles/:username/follow handled by socialNetwork.ts; social profiles username follow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2434
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/profiles/:username/follow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/:username/follow", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

930. PUT /api/social/profiles/:username/follow

• Purpose: PUT /api/social/profiles/:username/follow handled by socialNetwork.ts; social profiles username follow route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2402
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/profiles/:username/follow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/:username/follow", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

931. POST /api/social/profiles/:username/reports

• Purpose: POST /api/social/profiles/:username/reports handled by socialNetwork.ts; social profiles username reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2756
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/profiles/:username/reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/:username/reports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

932. PATCH /api/social/profiles/me/bio

• Purpose: PATCH /api/social/profiles/me/bio handled by socialNetwork.ts; social profiles me bio route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2809
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/profiles/me/bio" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/me/bio", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

933. PATCH /api/social/profiles/me/expression

• Purpose: PATCH /api/social/profiles/me/expression handled by socialNetwork.ts; social profiles me expression route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2847
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/profiles/me/expression" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/me/expression", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

934. PUT /api/social/profiles/me/links

• Purpose: PUT /api/social/profiles/me/links handled by socialNetwork.ts; social profiles me links route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2870
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/profiles/me/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/me/links", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

935. PUT /api/social/profiles/me/media

• Purpose: PUT /api/social/profiles/me/media handled by socialNetwork.ts; social profiles me media route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2920
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/profiles/me/media" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/me/media", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

936. PUT /api/social/profiles/me/pinned-post

• Purpose: PUT /api/social/profiles/me/pinned-post handled by socialNetwork.ts; social profiles me pinned post route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2895
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/profiles/me/pinned-post" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/profiles/me/pinned-post", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

937. GET /api/social/public/events

• Purpose: GET /api/social/public/events handled by socialNetwork.ts; social public events route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3256
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/public/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/public/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

938. GET /api/social/public/events/:eventId/event-page

• Purpose: GET /api/social/public/events/:eventId/event-page handled by socialNetwork.ts; social public events eventId event page route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:4583
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/public/events/:eventId/event-page" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/public/events/:eventId/event-page", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

939. GET /api/social/relationships/following

• Purpose: GET /api/social/relationships/following handled by socialNetwork.ts; social relationships following route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2000
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/relationships/following" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/following", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

940. GET /api/social/relationships/friends

• Purpose: GET /api/social/relationships/friends handled by socialNetwork.ts; social relationships friends route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2056
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/relationships/friends" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

941. DELETE /api/social/relationships/friends/:friendshipId

• Purpose: DELETE /api/social/relationships/friends/:friendshipId handled by socialNetwork.ts; social relationships friends friendshipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2172
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: friendshipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/relationships/friends/:friendshipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/:friendshipId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

942. PATCH /api/social/relationships/friends/:friendshipId

• Purpose: PATCH /api/social/relationships/friends/:friendshipId handled by socialNetwork.ts; social relationships friends friendshipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2147
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: friendshipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/social/relationships/friends/:friendshipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/:friendshipId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

943. POST /api/social/relationships/friends/:friendshipId/block-everywhere

• Purpose: POST /api/social/relationships/friends/:friendshipId/block-everywhere handled by socialNetwork.ts; social relationships friends friendshipId block everywhere route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2196
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: friendshipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/relationships/friends/:friendshipId/block-everywhere" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/:friendshipId/block-everywhere", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

944. POST /api/social/relationships/friends/:friendshipId/unblock-everywhere

• Purpose: POST /api/social/relationships/friends/:friendshipId/unblock-everywhere handled by socialNetwork.ts; social relationships friends friendshipId unblock everywhere route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2219
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: friendshipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/relationships/friends/:friendshipId/unblock-everywhere" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/:friendshipId/unblock-everywhere", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

945. GET /api/social/relationships/friends/requests

• Purpose: GET /api/social/relationships/friends/requests handled by socialNetwork.ts; social relationships friends requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2079
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/relationships/friends/requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/requests", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

946. POST /api/social/relationships/friends/requests

• Purpose: POST /api/social/relationships/friends/requests handled by socialNetwork.ts; social relationships friends requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2100
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/relationships/friends/requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/requests", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

947. GET /api/social/relationships/friends/summary

• Purpose: GET /api/social/relationships/friends/summary handled by socialNetwork.ts; social relationships friends summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:2024
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/relationships/friends/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/relationships/friends/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

948. GET /api/social/safety/controls

• Purpose: GET /api/social/safety/controls handled by socialNetwork.ts; social safety controls route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5590
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/safety/controls" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/controls", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

949. DELETE /api/social/safety/controls/:username/:control

• Purpose: DELETE /api/social/safety/controls/:username/:control handled by socialNetwork.ts; social safety controls username control route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5660
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username, control
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/safety/controls/:username/:control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/controls/:username/:control", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

950. PUT /api/social/safety/controls/:username/:control

• Purpose: PUT /api/social/safety/controls/:username/:control handled by socialNetwork.ts; social safety controls username control route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5615
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: username, control
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/safety/controls/:username/:control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/controls/:username/:control", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

951. GET /api/social/safety/keyword-filters

• Purpose: GET /api/social/safety/keyword-filters handled by socialNetwork.ts; social safety keyword filters route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5546
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/safety/keyword-filters" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/keyword-filters", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

952. POST /api/social/safety/keyword-filters

• Purpose: POST /api/social/safety/keyword-filters handled by socialNetwork.ts; social safety keyword filters route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5559
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/safety/keyword-filters" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/keyword-filters", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

953. DELETE /api/social/safety/keyword-filters/:filterId

• Purpose: DELETE /api/social/safety/keyword-filters/:filterId handled by socialNetwork.ts; social safety keyword filters filterId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:5577
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: filterId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/safety/keyword-filters/:filterId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/safety/keyword-filters/:filterId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

954. DELETE /api/social/staff/accounts/:accountId/partner-scope

• Purpose: DELETE /api/social/staff/accounts/:accountId/partner-scope handled by socialNetwork.ts; social staff accounts accountId partner scope route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3627
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/staff/accounts/:accountId/partner-scope" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/accounts/:accountId/partner-scope", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

955. PUT /api/social/staff/accounts/:accountId/partner-scope

• Purpose: PUT /api/social/staff/accounts/:accountId/partner-scope handled by socialNetwork.ts; social staff accounts accountId partner scope route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3626
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/staff/accounts/:accountId/partner-scope" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/accounts/:accountId/partner-scope", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

956. GET /api/social/staff/cms-event-mappings

• Purpose: GET /api/social/staff/cms-event-mappings handled by socialNetwork.ts; social staff cms event mappings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3426
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/staff/cms-event-mappings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/cms-event-mappings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

957. PUT /api/social/staff/cms-events/:documentId/canonical-event

• Purpose: PUT /api/social/staff/cms-events/:documentId/canonical-event handled by socialNetwork.ts; social staff cms events documentId canonical event route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3461
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: documentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/staff/cms-events/:documentId/canonical-event" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/cms-events/:documentId/canonical-event", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

958. POST /api/social/staff/event-discovery-webhook/reconcile

• Purpose: POST /api/social/staff/event-discovery-webhook/reconcile handled by socialNetwork.ts; social staff event discovery webhook reconcile route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3412
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social/staff/event-discovery-webhook/reconcile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/event-discovery-webhook/reconcile", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

959. DELETE /api/social/staff/pages/:pageId/partner-scope

• Purpose: DELETE /api/social/staff/pages/:pageId/partner-scope handled by socialNetwork.ts; social staff pages pageId partner scope route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3625
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: pageId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/staff/pages/:pageId/partner-scope" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/pages/:pageId/partner-scope", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

960. PUT /api/social/staff/pages/:pageId/partner-scope

• Purpose: PUT /api/social/staff/pages/:pageId/partner-scope handled by socialNetwork.ts; social staff pages pageId partner scope route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3624
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: pageId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/staff/pages/:pageId/partner-scope" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/pages/:pageId/partner-scope", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

961. GET /api/social/staff/partner-scopes

• Purpose: GET /api/social/staff/partner-scopes handled by socialNetwork.ts; social staff partner scopes route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3556
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/staff/partner-scopes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/partner-scopes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

962. GET /api/social/staff/partner-scopes/subjects

• Purpose: GET /api/social/staff/partner-scopes/subjects handled by socialNetwork.ts; social staff partner scopes subjects route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3575
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/staff/partner-scopes/subjects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/staff/partner-scopes/subjects", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

963. GET /api/social/starter-packs

• Purpose: GET /api/social/starter-packs handled by socialNetwork.ts; social starter packs route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3003
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/starter-packs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/starter-packs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

964. DELETE /api/social/starter-packs/:slug

• Purpose: DELETE /api/social/starter-packs/:slug handled by socialNetwork.ts; social starter packs slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3036
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/social/starter-packs/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/starter-packs/:slug", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

965. PUT /api/social/starter-packs/:slug

• Purpose: PUT /api/social/starter-packs/:slug handled by socialNetwork.ts; social starter packs slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:3016
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/social/starter-packs/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/starter-packs/:slug", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

966. GET /api/social/topics/:topicId/posts

• Purpose: GET /api/social/topics/:topicId/posts handled by socialNetwork.ts; social topics topicId posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialNetwork.ts:1792
• Mounted prefix: /api/social
• Route module: socialNetwork.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: topicId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social/topics/:topicId/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social/topics/:topicId/posts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

967. GET /api/surveys

• Purpose: GET /api/surveys handled by surveys.ts; surveys route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:551
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

968. POST /api/surveys

• Purpose: POST /api/surveys handled by surveys.ts; surveys route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:594
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

969. GET /api/surveys/:surveyId

• Purpose: GET /api/surveys/:surveyId handled by surveys.ts; surveys surveyId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:834
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

970. PATCH /api/surveys/:surveyId

• Purpose: PATCH /api/surveys/:surveyId handled by surveys.ts; surveys surveyId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:840
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/surveys/:surveyId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

971. POST /api/surveys/:surveyId/analysis

• Purpose: POST /api/surveys/:surveyId/analysis handled by surveys.ts; surveys surveyId analysis route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1580
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/analysis" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/analysis", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

972. GET /api/surveys/:surveyId/analytics

• Purpose: GET /api/surveys/:surveyId/analytics handled by surveys.ts; surveys surveyId analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1367
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

973. GET /api/surveys/:surveyId/audit

• Purpose: GET /api/surveys/:surveyId/audit handled by surveys.ts; surveys surveyId audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1513
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

974. POST /api/surveys/:surveyId/duplicate

• Purpose: POST /api/surveys/:surveyId/duplicate handled by surveys.ts; surveys surveyId duplicate route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:886
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/duplicate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/duplicate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

975. GET /api/surveys/:surveyId/export.csv

• Purpose: GET /api/surveys/:surveyId/export.csv handled by surveys.ts; surveys surveyId export.csv route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1200
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

976. GET /api/surveys/:surveyId/export.json

• Purpose: GET /api/surveys/:surveyId/export.json handled by surveys.ts; surveys surveyId export.json route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1231
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/export.json" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/export.json", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

977. GET /api/surveys/:surveyId/export.xlsx

• Purpose: GET /api/surveys/:surveyId/export.xlsx handled by surveys.ts; surveys surveyId export.xlsx route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1215
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/export.xlsx" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/export.xlsx", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

978. GET /api/surveys/:surveyId/invitations

• Purpose: GET /api/surveys/:surveyId/invitations handled by surveys.ts; surveys surveyId invitations route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:792
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/invitations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/invitations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

979. POST /api/surveys/:surveyId/invitations

• Purpose: POST /api/surveys/:surveyId/invitations handled by surveys.ts; surveys surveyId invitations route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:802
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/invitations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/invitations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

980. DELETE /api/surveys/:surveyId/invitations/:invitationId

• Purpose: DELETE /api/surveys/:surveyId/invitations/:invitationId handled by surveys.ts; surveys surveyId invitations invitationId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:820
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, invitationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/surveys/:surveyId/invitations/:invitationId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/invitations/:invitationId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

981. POST /api/surveys/:surveyId/lifecycle

• Purpose: POST /api/surveys/:surveyId/lifecycle handled by surveys.ts; surveys surveyId lifecycle route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:918
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/lifecycle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/lifecycle", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

982. POST /api/surveys/:surveyId/publish

• Purpose: POST /api/surveys/:surveyId/publish handled by surveys.ts; surveys surveyId publish route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:903
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

983. GET /api/surveys/:surveyId/question-bank

• Purpose: GET /api/surveys/:surveyId/question-bank handled by surveys.ts; surveys surveyId question bank route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:686
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/question-bank" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/question-bank", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

984. POST /api/surveys/:surveyId/question-bank

• Purpose: POST /api/surveys/:surveyId/question-bank handled by surveys.ts; surveys surveyId question bank route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:698
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/question-bank" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/question-bank", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

985. DELETE /api/surveys/:surveyId/question-bank/:itemId

• Purpose: DELETE /api/surveys/:surveyId/question-bank/:itemId handled by surveys.ts; surveys surveyId question bank itemId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:713
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, itemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/surveys/:surveyId/question-bank/:itemId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/question-bank/:itemId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

986. GET /api/surveys/:surveyId/report-schedules

• Purpose: GET /api/surveys/:surveyId/report-schedules handled by surveys.ts; surveys surveyId report schedules route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1327
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/report-schedules" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/report-schedules", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

987. POST /api/surveys/:surveyId/report-schedules

• Purpose: POST /api/surveys/:surveyId/report-schedules handled by surveys.ts; surveys surveyId report schedules route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1337
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/report-schedules" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/report-schedules", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

988. PATCH /api/surveys/:surveyId/report-schedules/:scheduleId

• Purpose: PATCH /api/surveys/:surveyId/report-schedules/:scheduleId handled by surveys.ts; surveys surveyId report schedules scheduleId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1349
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, scheduleId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/surveys/:surveyId/report-schedules/:scheduleId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/report-schedules/:scheduleId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

989. GET /api/surveys/:surveyId/reports

• Purpose: GET /api/surveys/:surveyId/reports handled by surveys.ts; surveys surveyId reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1263
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

990. POST /api/surveys/:surveyId/reports

• Purpose: POST /api/surveys/:surveyId/reports handled by surveys.ts; surveys surveyId reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1272
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

991. GET /api/surveys/:surveyId/reports/:reportId/shares

• Purpose: GET /api/surveys/:surveyId/reports/:reportId/shares handled by surveys.ts; surveys surveyId reports reportId shares route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1287
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, reportId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/reports/:reportId/shares" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reports/:reportId/shares", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

992. POST /api/surveys/:surveyId/reports/:reportId/shares

• Purpose: POST /api/surveys/:surveyId/reports/:reportId/shares handled by surveys.ts; surveys surveyId reports reportId shares route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1297
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, reportId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/reports/:reportId/shares" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reports/:reportId/shares", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

993. DELETE /api/surveys/:surveyId/reports/:reportId/shares/:shareId

• Purpose: DELETE /api/surveys/:surveyId/reports/:reportId/shares/:shareId handled by surveys.ts; surveys surveyId reports reportId shares shareId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1316
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, reportId, shareId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/surveys/:surveyId/reports/:reportId/shares/:shareId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reports/:reportId/shares/:shareId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

994. GET /api/surveys/:surveyId/responses

• Purpose: GET /api/surveys/:surveyId/responses handled by surveys.ts; surveys surveyId responses route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1168
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/responses" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/responses", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

995. GET /api/surveys/:surveyId/responses/:responseId

• Purpose: GET /api/surveys/:surveyId/responses/:responseId handled by surveys.ts; surveys surveyId responses responseId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1176
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, responseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/responses/:responseId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/responses/:responseId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

996. POST /api/surveys/:surveyId/responses/:responseId/lifecycle

• Purpose: POST /api/surveys/:surveyId/responses/:responseId/lifecycle handled by surveys.ts; surveys surveyId responses responseId lifecycle route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1185
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, responseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/responses/:responseId/lifecycle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/responses/:responseId/lifecycle", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

997. GET /api/surveys/:surveyId/reward-claims

• Purpose: GET /api/surveys/:surveyId/reward-claims handled by surveys.ts; surveys surveyId reward claims route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1553
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/reward-claims" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reward-claims", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

998. PATCH /api/surveys/:surveyId/reward-claims/:claimId

• Purpose: PATCH /api/surveys/:surveyId/reward-claims/:claimId handled by surveys.ts; surveys surveyId reward claims claimId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1563
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, claimId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/surveys/:surveyId/reward-claims/:claimId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/reward-claims/:claimId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

999. GET /api/surveys/:surveyId/rewards

• Purpose: GET /api/surveys/:surveyId/rewards handled by surveys.ts; surveys surveyId rewards route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1523
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/rewards" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/rewards", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1000. POST /api/surveys/:surveyId/rewards

• Purpose: POST /api/surveys/:surveyId/rewards handled by surveys.ts; surveys surveyId rewards route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1533
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/rewards" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/rewards", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1001. POST /api/surveys/:surveyId/templates

• Purpose: POST /api/surveys/:surveyId/templates handled by surveys.ts; surveys surveyId templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:870
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1002. GET /api/surveys/:surveyId/webhook-deliveries

• Purpose: GET /api/surveys/:surveyId/webhook-deliveries handled by surveys.ts; surveys surveyId webhook deliveries route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:784
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/webhook-deliveries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/webhook-deliveries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1003. GET /api/surveys/:surveyId/webhooks

• Purpose: GET /api/surveys/:surveyId/webhooks handled by surveys.ts; surveys surveyId webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:740
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/:surveyId/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/webhooks", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1004. POST /api/surveys/:surveyId/webhooks

• Purpose: POST /api/surveys/:surveyId/webhooks handled by surveys.ts; surveys surveyId webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:750
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/:surveyId/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/webhooks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1005. PATCH /api/surveys/:surveyId/webhooks/:endpointId

• Purpose: PATCH /api/surveys/:surveyId/webhooks/:endpointId handled by surveys.ts; surveys surveyId webhooks endpointId route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:767
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: surveyId, endpointId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/surveys/:surveyId/webhooks/:endpointId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/:surveyId/webhooks/:endpointId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1006. GET /api/surveys/account/:slug

• Purpose: GET /api/surveys/account/:slug handled by surveys.ts; surveys account slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:950
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/account/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/account/:slug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1007. GET /api/surveys/account/:slug/recovery-context

• Purpose: GET /api/surveys/account/:slug/recovery-context handled by surveys.ts; surveys account slug recovery context route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:967
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/account/:slug/recovery-context" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/account/:slug/recovery-context", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1008. POST /api/surveys/account/:slug/submissions

• Purpose: POST /api/surveys/account/:slug/submissions handled by surveys.ts; surveys account slug submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1093
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/account/:slug/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/account/:slug/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1009. GET /api/surveys/analytics/summary

• Purpose: GET /api/surveys/analytics/summary handled by surveys.ts; surveys analytics summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1628
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/analytics/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/analytics/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1010. GET /api/surveys/fph-staff-grants

• Purpose: GET /api/surveys/fph-staff-grants handled by surveys.ts; surveys fph staff grants route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:626
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/fph-staff-grants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/fph-staff-grants", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1011. POST /api/surveys/fph-staff-grants

• Purpose: POST /api/surveys/fph-staff-grants handled by surveys.ts; surveys fph staff grants route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:637
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/fph-staff-grants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/fph-staff-grants", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1012. DELETE /api/surveys/fph-staff-grants/:userId/:permission

• Purpose: DELETE /api/surveys/fph-staff-grants/:userId/:permission handled by surveys.ts; surveys fph staff grants userId permission route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:652
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: userId, permission
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/surveys/fph-staff-grants/:userId/:permission" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/fph-staff-grants/:userId/:permission", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1013. GET /api/surveys/invite/:token

• Purpose: GET /api/surveys/invite/:token handled by surveys.ts; surveys invite token route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:984
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: token
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/invite/:token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/invite/:token", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1014. POST /api/surveys/invite/:token/submissions

• Purpose: POST /api/surveys/invite/:token/submissions handled by surveys.ts; surveys invite token submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1126
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: token
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/invite/:token/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/invite/:token/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1015. GET /api/surveys/public-paths

• Purpose: GET /api/surveys/public-paths handled by surveys.ts; surveys public paths route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:727
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/public-paths" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/public-paths", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1016. GET /api/surveys/public/:slug

• Purpose: GET /api/surveys/public/:slug handled by surveys.ts; surveys public slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:936
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/public/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/public/:slug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1017. POST /api/surveys/public/:slug/events

• Purpose: POST /api/surveys/public/:slug/events handled by surveys.ts; surveys public slug events route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:997
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/public/:slug/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/public/:slug/events", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1018. PUT /api/surveys/public/:slug/progress

• Purpose: PUT /api/surveys/public/:slug/progress handled by surveys.ts; surveys public slug progress route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1011
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/surveys/public/:slug/progress" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/public/:slug/progress", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1019. POST /api/surveys/public/:slug/submissions

• Purpose: POST /api/surveys/public/:slug/submissions handled by surveys.ts; surveys public slug submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1037
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/public/:slug/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/public/:slug/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1020. POST /api/surveys/responses/:responseId/no-perks

• Purpose: POST /api/surveys/responses/:responseId/no-perks handled by surveys.ts; surveys responses responseId no perks route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1672
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: responseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/responses/:responseId/no-perks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/responses/:responseId/no-perks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1021. POST /api/surveys/responses/:responseId/rewards/claim

• Purpose: POST /api/surveys/responses/:responseId/rewards/claim handled by surveys.ts; surveys responses responseId rewards claim route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1660
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: responseId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/surveys/responses/:responseId/rewards/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/responses/:responseId/rewards/claim", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1022. GET /api/surveys/scopes

• Purpose: GET /api/surveys/scopes handled by surveys.ts; surveys scopes route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:574
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/scopes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/scopes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1023. GET /api/surveys/shared-reports

• Purpose: GET /api/surveys/shared-reports handled by surveys.ts; surveys shared reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:1243
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/shared-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/shared-reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1024. GET /api/surveys/templates

• Purpose: GET /api/surveys/templates handled by surveys.ts; surveys templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/surveys.ts:664
• Mounted prefix: /api
• Route module: surveys.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/surveys/templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/surveys/templates", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1025. POST /api/v2/admissions

• Purpose: POST /api/v2/admissions handled by v2Admission.ts; v2 admissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Admission.ts:16
• Mounted prefix: /api/v2
• Route module: v2Admission.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/v2/admissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/admissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1026. DELETE /api/v2/admissions/:membershipId

• Purpose: DELETE /api/v2/admissions/:membershipId handled by v2Admission.ts; v2 admissions membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Admission.ts:27
• Mounted prefix: /api/v2
• Route module: v2Admission.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/v2/admissions/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/admissions/:membershipId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1027. GET /api/v2/profile

• Purpose: GET /api/v2/profile handled by v2Profile.ts; v2 profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:24
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/v2/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1028. PUT /api/v2/profile

• Purpose: PUT /api/v2/profile handled by v2Profile.ts; v2 profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:25
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/v2/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1029. POST /api/v2/profile/legal-acceptances

• Purpose: POST /api/v2/profile/legal-acceptances handled by v2Profile.ts; v2 profile legal acceptances route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:35
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/v2/profile/legal-acceptances" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/legal-acceptances", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1030. PATCH /api/v2/profile/notification-preferences

• Purpose: PATCH /api/v2/profile/notification-preferences handled by v2Profile.ts; v2 profile notification preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:33
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/v2/profile/notification-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/notification-preferences", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1031. POST /api/v2/profile/phone/validate

• Purpose: POST /api/v2/profile/phone/validate handled by v2Profile.ts; v2 profile phone validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:30
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/v2/profile/phone/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/phone/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1032. PATCH /api/v2/profile/photo

• Purpose: PATCH /api/v2/profile/photo handled by v2Profile.ts; v2 profile photo route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:34
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/v2/profile/photo" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/photo", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1033. PATCH /api/v2/profile/username

• Purpose: PATCH /api/v2/profile/username handled by v2Profile.ts; v2 profile username route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:32
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/v2/profile/username" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/username", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1034. GET /api/v2/profile/username/check

• Purpose: GET /api/v2/profile/username/check handled by v2Profile.ts; v2 profile username check route contract must be verified against source before integration.
• Source: partners-api/src/routes/v2Profile.ts:31
• Mounted prefix: /api/v2
• Route module: v2Profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/v2/profile/username/check" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/v2/profile/username/check", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1035. POST /hooks/discord-finance

• Purpose: POST /hooks/discord-finance handled by financeInteractions.ts; hooks discord finance route contract must be verified against source before integration.
• Source: partners-api/src/routes/financeInteractions.ts:31
• Mounted prefix: /hooks
• Route module: financeInteractions.ts
• Router variable: routes
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/discord-finance" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/discord-finance", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1036. POST /public/site-reports

• Purpose: POST /public/site-reports handled by siteReports.ts; public site reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/siteReports.ts:53
• Mounted prefix: /public/site-reports
• Route module: siteReports.ts
• Router variable: reports
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/public/site-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/public/site-reports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1037. GET /public/site-reports/config

• Purpose: GET /public/site-reports/config handled by siteReports.ts; public site reports config route contract must be verified against source before integration.
• Source: partners-api/src/routes/siteReports.ts:25
• Mounted prefix: /public/site-reports
• Route module: siteReports.ts
• Router variable: reports
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/public/site-reports/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/public/site-reports/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1038. GET /public/site-reports/identity

• Purpose: GET /public/site-reports/identity handled by siteReports.ts; public site reports identity route contract must be verified against source before integration.
• Source: partners-api/src/routes/siteReports.ts:33
• Mounted prefix: /public/site-reports
• Route module: siteReports.ts
• Router variable: reports
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/public/site-reports/identity" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/public/site-reports/identity", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1039. GET /public/site-reports/widget.js

• Purpose: GET /public/site-reports/widget.js handled by siteReports.ts; public site reports widget.js route contract must be verified against source before integration.
• Source: partners-api/src/routes/siteReports.ts:18
• Mounted prefix: /public/site-reports
• Route module: siteReports.ts
• Router variable: reports
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/public/site-reports/widget.js" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/public/site-reports/widget.js", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

1040. GET /api/events/:id/group-rego-settings

• Purpose: GET /api/events/:id/group-rego-settings handled by groupRego.ts; events id group rego settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:819
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1041. PUT /api/events/:id/group-rego-settings

• Purpose: PUT /api/events/:id/group-rego-settings handled by groupRego.ts; events id group rego settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:843
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1042. GET /api/events/:id/rego-gifts

• Purpose: GET /api/events/:id/rego-gifts handled by rego.ts; events id rego gifts route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2144
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1043. POST /api/events/:id/rego-gifts/:giftId/payment-review

• Purpose: POST /api/events/:id/rego-gifts/:giftId/payment-review handled by rego.ts; events id rego gifts giftId payment review route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2166
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, giftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/rego-gifts/:giftId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts/:giftId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1044. POST /api/events/:id/reserve-slot

• Purpose: POST /api/events/:id/reserve-slot handled by regoReservations.ts; events id reserve slot route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoReservations.ts:12
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/reserve-slot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/reserve-slot", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1045. GET /api/events/:id/waitlist-config

• Purpose: GET /api/events/:id/waitlist-config handled by waitlist.ts; events id waitlist config route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:263
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/waitlist-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1046. PUT /api/events/:id/waitlist-config/:subjectType/:subjectId

• Purpose: PUT /api/events/:id/waitlist-config/:subjectType/:subjectId handled by waitlist.ts; events id waitlist config subjectType subjectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:298
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, subjectType, subjectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/waitlist-config/:subjectType/:subjectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config/:subjectType/:subjectId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1047. POST /api/events/:id/waitlist/process-next/:tierId

• Purpose: POST /api/events/:id/waitlist/process-next/:tierId handled by waitlist.ts; events id waitlist process next tierId route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:388
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, tierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/waitlist/process-next/:tierId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist/process-next/:tierId", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1048. POST /api/internal/waitlist/expire-offers

• Purpose: POST /api/internal/waitlist/expire-offers handled by waitlist.ts; internal waitlist expire offers route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:542
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/waitlist/expire-offers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/waitlist/expire-offers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1049. GET /api/manage/:id/group-rego-settings

• Purpose: GET /api/manage/:id/group-rego-settings is the Event Management compatibility alias for /api/events/:id/group-rego-settings.
• Source: partners-api/src/routes/groupRego.ts:819
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1050. PUT /api/manage/:id/group-rego-settings

• Purpose: PUT /api/manage/:id/group-rego-settings is the Event Management compatibility alias for /api/events/:id/group-rego-settings.
• Source: partners-api/src/routes/groupRego.ts:843
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1051. GET /api/manage/:id/rego-gifts

• Purpose: GET /api/manage/:id/rego-gifts is the Event Management compatibility alias for /api/events/:id/rego-gifts.
• Source: partners-api/src/routes/rego.ts:2144
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1052. POST /api/manage/:id/rego-gifts/:giftId/payment-review

• Purpose: POST /api/manage/:id/rego-gifts/:giftId/payment-review is the Event Management compatibility alias for /api/events/:id/rego-gifts/:giftId/payment-review.
• Source: partners-api/src/routes/rego.ts:2166
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, giftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/rego-gifts/:giftId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts/:giftId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1053. POST /api/manage/:id/reserve-slot

• Purpose: POST /api/manage/:id/reserve-slot is the Event Management compatibility alias for /api/events/:id/reserve-slot.
• Source: partners-api/src/routes/regoReservations.ts:12
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/reserve-slot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/reserve-slot", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1054. GET /api/manage/:id/waitlist-config

• Purpose: GET /api/manage/:id/waitlist-config is the Event Management compatibility alias for /api/events/:id/waitlist-config.
• Source: partners-api/src/routes/waitlist.ts:263
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/waitlist-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1055. PUT /api/manage/:id/waitlist-config/:subjectType/:subjectId

• Purpose: PUT /api/manage/:id/waitlist-config/:subjectType/:subjectId is the Event Management compatibility alias for /api/events/:id/waitlist-config/:subjectType/:subjectId.
• Source: partners-api/src/routes/waitlist.ts:298
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, subjectType, subjectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/waitlist-config/:subjectType/:subjectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config/:subjectType/:subjectId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1056. POST /api/manage/:id/waitlist/process-next/:tierId

• Purpose: POST /api/manage/:id/waitlist/process-next/:tierId is the Event Management compatibility alias for /api/events/:id/waitlist/process-next/:tierId.
• Source: partners-api/src/routes/waitlist.ts:388
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, tierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/waitlist/process-next/:tierId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist/process-next/:tierId", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1057. POST /api/rego-reservations/:id/release

• Purpose: POST /api/rego-reservations/:id/release handled by regoReservations.ts; rego reservations id release route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoReservations.ts:36
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego-reservations/:id/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego-reservations/:id/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1058. GET /api/rego/affiliate-rewards

• Purpose: GET /api/rego/affiliate-rewards handled by regoAffiliateRewards.ts; rego affiliate rewards route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAffiliateRewards.ts:18
• Mounted prefix: /api
• Route module: regoAffiliateRewards.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/affiliate-rewards" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/affiliate-rewards", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1059. PUT /api/rego/affiliate-rewards/:affiliateId/payout

• Purpose: PUT /api/rego/affiliate-rewards/:affiliateId/payout handled by regoAffiliateRewards.ts; rego affiliate rewards affiliateId payout route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAffiliateRewards.ts:30
• Mounted prefix: /api
• Route module: regoAffiliateRewards.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: affiliateId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/affiliate-rewards/:affiliateId/payout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/affiliate-rewards/:affiliateId/payout", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1060. GET /api/rego/events

• Purpose: GET /api/rego/events handled by rego.ts; rego events route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1187
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1061. GET /api/rego/events/:slug

• Purpose: GET /api/rego/events/:slug handled by rego.ts; rego events slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1279
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1062. GET /api/rego/events/:slug/gift/recipient

• Purpose: GET /api/rego/events/:slug/gift/recipient handled by rego.ts; rego events slug gift recipient route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1663
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/gift/recipient" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/gift/recipient", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1063. GET /api/rego/fursonas

• Purpose: GET /api/rego/fursonas handled by fursonas.ts; rego fursonas route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:69
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/fursonas" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1064. POST /api/rego/fursonas

• Purpose: POST /api/rego/fursonas handled by fursonas.ts; rego fursonas route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:90
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/fursonas" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1065. DELETE /api/rego/fursonas/:id

• Purpose: DELETE /api/rego/fursonas/:id handled by fursonas.ts; rego fursonas id route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:195
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/fursonas/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1066. PUT /api/rego/fursonas/:id

• Purpose: PUT /api/rego/fursonas/:id handled by fursonas.ts; rego fursonas id route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:136
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/fursonas/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1067. DELETE /api/rego/fursonas/:id/refs

• Purpose: DELETE /api/rego/fursonas/:id/refs handled by fursonas.ts; rego fursonas id refs route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:282
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/fursonas/:id/refs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1068. POST /api/rego/fursonas/:id/refs

• Purpose: POST /api/rego/fursonas/:id/refs handled by fursonas.ts; rego fursonas id refs route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:232
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/fursonas/:id/refs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1069. PUT /api/rego/fursonas/:id/refs/latest

• Purpose: PUT /api/rego/fursonas/:id/refs/latest handled by fursonas.ts; rego fursonas id refs latest route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:332
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/fursonas/:id/refs/latest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs/latest", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1070. POST /api/rego/gifts

• Purpose: POST /api/rego/gifts handled by rego.ts; rego gifts route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1783
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1071. GET /api/rego/gifts/:id

• Purpose: GET /api/rego/gifts/:id handled by rego.ts; rego gifts id route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2113
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/gifts/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1072. POST /api/rego/gifts/:id/redeem

• Purpose: POST /api/rego/gifts/:id/redeem handled by rego.ts; rego gifts id redeem route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2136
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts/:id/redeem" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/:id/redeem", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1073. GET /api/rego/gifts/me

• Purpose: GET /api/rego/gifts/me handled by rego.ts; rego gifts me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2089
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/gifts/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1074. POST /api/rego/gifts/quote

• Purpose: POST /api/rego/gifts/quote handled by rego.ts; rego gifts quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1712
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1075. POST /api/rego/groups

• Purpose: POST /api/rego/groups handled by groupRego.ts; rego groups route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:245
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1076. GET /api/rego/groups/:id

• Purpose: GET /api/rego/groups/:id handled by groupRego.ts; rego groups id route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:397
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1077. PATCH /api/rego/groups/:id/accept

• Purpose: PATCH /api/rego/groups/:id/accept handled by groupRego.ts; rego groups id accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:552
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/accept", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1078. PATCH /api/rego/groups/:id/cancel

• Purpose: PATCH /api/rego/groups/:id/cancel handled by groupRego.ts; rego groups id cancel route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:566
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/cancel" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/cancel", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1079. PATCH /api/rego/groups/:id/decline

• Purpose: PATCH /api/rego/groups/:id/decline handled by groupRego.ts; rego groups id decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:559
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/decline", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1080. POST /api/rego/groups/:id/invite

• Purpose: POST /api/rego/groups/:id/invite handled by groupRego.ts; rego groups id invite route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:440
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups/:id/invite" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/invite", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1081. DELETE /api/rego/groups/:id/members/:memberId

• Purpose: DELETE /api/rego/groups/:id/members/:memberId handled by groupRego.ts; rego groups id members memberId route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:648
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, memberId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/groups/:id/members/:memberId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/members/:memberId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1082. PATCH /api/rego/groups/:id/members/:memberId

• Purpose: PATCH /api/rego/groups/:id/members/:memberId handled by groupRego.ts; rego groups id members memberId route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:598
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, memberId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/members/:memberId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/members/:memberId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1083. POST /api/rego/groups/:id/submit

• Purpose: POST /api/rego/groups/:id/submit handled by rego.ts; rego groups id submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:3328
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups/:id/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1084. GET /api/rego/groups/:id/totals

• Purpose: GET /api/rego/groups/:id/totals handled by groupRego.ts; rego groups id totals route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:685
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/:id/totals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/totals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1085. GET /api/rego/groups/my

• Purpose: GET /api/rego/groups/my handled by groupRego.ts; rego groups my route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:339
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1086. POST /api/rego/internal/archive-expired

• Purpose: POST /api/rego/internal/archive-expired handled by rego.ts; rego internal archive expired route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:4250
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/internal/archive-expired" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/internal/archive-expired", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1087. POST /api/rego/payment-link-reference

• Purpose: POST /api/rego/payment-link-reference handled by rego.ts; rego payment link reference route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1482
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/payment-link-reference" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/payment-link-reference", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1088. PUT /api/rego/prefills

• Purpose: PUT /api/rego/prefills handled by rego.ts; rego prefills route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2270
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1089. DELETE /api/rego/prefills/:eventId

• Purpose: DELETE /api/rego/prefills/:eventId handled by rego.ts; rego prefills eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2476
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/prefills/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills/:eventId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1090. GET /api/rego/prefills/:eventId

• Purpose: GET /api/rego/prefills/:eventId handled by rego.ts; rego prefills eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2234
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/prefills/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1091. POST /api/rego/quote

• Purpose: POST /api/rego/quote handled by rego.ts; rego quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1557
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1092. POST /api/rego/regos

• Purpose: POST /api/rego/regos handled by rego.ts; rego regos route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2832
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1093. GET /api/rego/regos/:ref

• Purpose: GET /api/rego/regos/:ref handled by rego.ts; rego regos ref route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2570
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1094. GET /api/rego/regos/:ref/wallet

• Purpose: GET /api/rego/regos/:ref/wallet handled by rego.ts; rego regos ref wallet route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2762
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/wallet" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/wallet", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1095. GET /api/rego/regos/me

• Purpose: GET /api/rego/regos/me handled by rego.ts; rego regos me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2502
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1096. POST /api/rego/waitlist

• Purpose: POST /api/rego/waitlist handled by rego.ts; rego waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:4160
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1097. POST /api/rego/waitlist/:entryId/accept

• Purpose: POST /api/rego/waitlist/:entryId/accept handled by waitlist.ts; rego waitlist entryId accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:516
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist/:entryId/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/:entryId/accept", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1098. POST /api/rego/waitlist/:entryId/decline

• Purpose: POST /api/rego/waitlist/:entryId/decline handled by waitlist.ts; rego waitlist entryId decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:431
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist/:entryId/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/:entryId/decline", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1099. GET /api/rego/waitlist/me

• Purpose: GET /api/rego/waitlist/me handled by rego.ts; rego waitlist me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:4118
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/waitlist/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1100. GET /api/rego/waitlist/pending-offer

• Purpose: GET /api/rego/waitlist/pending-offer handled by waitlist.ts; rego waitlist pending offer route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:413
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/waitlist/pending-offer" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/pending-offer", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

1101. GET /api/events/:id/social/bot-settings

• Purpose: GET /api/events/:id/social/bot-settings handled by socialLinking.ts; events id social bot settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1862
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1102. PATCH /api/events/:id/social/bot-settings

• Purpose: PATCH /api/events/:id/social/bot-settings handled by socialLinking.ts; events id social bot settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1903
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1103. GET /api/events/:id/social/discord/guilds

• Purpose: GET /api/events/:id/social/discord/guilds handled by socialLinking.ts; events id social discord guilds route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1744
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1104. GET /api/events/:id/social/discord/guilds/:guildId/roles

• Purpose: GET /api/events/:id/social/discord/guilds/:guildId/roles handled by socialLinking.ts; events id social discord guilds guildId roles route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1765
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds/:guildId/roles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds/:guildId/roles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1105. GET /api/events/:id/social/discord/link/start

• Purpose: GET /api/events/:id/social/discord/link/start handled by socialLinking.ts; events id social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1668
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1106. GET /api/events/:id/social/telegram/chats

• Purpose: GET /api/events/:id/social/telegram/chats handled by socialLinking.ts; events id social telegram chats route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1801
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/chats" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/chats", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1107. POST /api/events/:id/social/telegram/link/complete

• Purpose: POST /api/events/:id/social/telegram/link/complete handled by socialLinking.ts; events id social telegram link complete route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1929
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/social/telegram/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1108. GET /api/events/:id/social/telegram/link/start

• Purpose: GET /api/events/:id/social/telegram/link/start handled by socialLinking.ts; events id social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1698
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1109. GET /api/events/:id/zep/app-bundle

• Purpose: GET /api/events/:id/zep/app-bundle handled by zep.ts; events id zep app bundle route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:484
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/app-bundle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/app-bundle", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1110. GET /api/events/:id/zep/config

• Purpose: GET /api/events/:id/zep/config handled by zep.ts; events id zep config route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:422
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1111. PUT /api/events/:id/zep/config

• Purpose: PUT /api/events/:id/zep/config handled by zep.ts; events id zep config route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:501
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1112. POST /api/internal/social-entitlements/reconcile

• Purpose: POST /api/internal/social-entitlements/reconcile handled by socialLinking.ts; internal social entitlements reconcile route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:2288
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: internalApi
• Stability: partner dashboard internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/social-entitlements/reconcile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/social-entitlements/reconcile", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1113. GET /api/manage/:id/social/bot-settings

• Purpose: GET /api/manage/:id/social/bot-settings is the Event Management compatibility alias for /api/events/:id/social/bot-settings.
• Source: partners-api/src/routes/socialLinking.ts:1862
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1114. PATCH /api/manage/:id/social/bot-settings

• Purpose: PATCH /api/manage/:id/social/bot-settings is the Event Management compatibility alias for /api/events/:id/social/bot-settings.
• Source: partners-api/src/routes/socialLinking.ts:1903
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1115. GET /api/manage/:id/social/discord/guilds

• Purpose: GET /api/manage/:id/social/discord/guilds is the Event Management compatibility alias for /api/events/:id/social/discord/guilds.
• Source: partners-api/src/routes/socialLinking.ts:1744
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1116. GET /api/manage/:id/social/discord/guilds/:guildId/roles

• Purpose: GET /api/manage/:id/social/discord/guilds/:guildId/roles is the Event Management compatibility alias for /api/events/:id/social/discord/guilds/:guildId/roles.
• Source: partners-api/src/routes/socialLinking.ts:1765
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds/:guildId/roles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds/:guildId/roles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1117. GET /api/manage/:id/social/discord/link/start

• Purpose: GET /api/manage/:id/social/discord/link/start is the Event Management compatibility alias for /api/events/:id/social/discord/link/start.
• Source: partners-api/src/routes/socialLinking.ts:1668
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1118. GET /api/manage/:id/social/telegram/chats

• Purpose: GET /api/manage/:id/social/telegram/chats is the Event Management compatibility alias for /api/events/:id/social/telegram/chats.
• Source: partners-api/src/routes/socialLinking.ts:1801
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/chats" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/chats", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1119. POST /api/manage/:id/social/telegram/link/complete

• Purpose: POST /api/manage/:id/social/telegram/link/complete is the Event Management compatibility alias for /api/events/:id/social/telegram/link/complete.
• Source: partners-api/src/routes/socialLinking.ts:1929
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/social/telegram/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1120. GET /api/manage/:id/social/telegram/link/start

• Purpose: GET /api/manage/:id/social/telegram/link/start is the Event Management compatibility alias for /api/events/:id/social/telegram/link/start.
• Source: partners-api/src/routes/socialLinking.ts:1698
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1121. GET /api/manage/:id/zep/app-bundle

• Purpose: GET /api/manage/:id/zep/app-bundle is the Event Management compatibility alias for /api/events/:id/zep/app-bundle.
• Source: partners-api/src/routes/zep.ts:484
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/app-bundle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/app-bundle", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1122. GET /api/manage/:id/zep/config

• Purpose: GET /api/manage/:id/zep/config is the Event Management compatibility alias for /api/events/:id/zep/config.
• Source: partners-api/src/routes/zep.ts:422
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1123. PUT /api/manage/:id/zep/config

• Purpose: PUT /api/manage/:id/zep/config is the Event Management compatibility alias for /api/events/:id/zep/config.
• Source: partners-api/src/routes/zep.ts:501
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1124. DELETE /api/org/social/discord/guilds/:guildId

• Purpose: DELETE /api/org/social/discord/guilds/:guildId handled by socialLinking.ts; org social discord guilds guildId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1822
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/org/social/discord/guilds/:guildId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/guilds/:guildId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1125. GET /api/org/social/discord/link/start

• Purpose: GET /api/org/social/discord/link/start handled by socialLinking.ts; org social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1492
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1126. POST /api/org/social/discord/unlink

• Purpose: POST /api/org/social/discord/unlink handled by socialLinking.ts; org social discord unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1522
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/discord/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1127. GET /api/org/social/settings

• Purpose: GET /api/org/social/settings handled by socialLinking.ts; org social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1452
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1128. POST /api/org/social/telegram/chat/link/complete

• Purpose: POST /api/org/social/telegram/chat/link/complete handled by socialLinking.ts; org social telegram chat link complete route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1642
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/telegram/chat/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chat/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1129. GET /api/org/social/telegram/chat/link/start

• Purpose: GET /api/org/social/telegram/chat/link/start handled by socialLinking.ts; org social telegram chat link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1600
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/telegram/chat/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chat/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1130. DELETE /api/org/social/telegram/chats/:chatId

• Purpose: DELETE /api/org/social/telegram/chats/:chatId handled by socialLinking.ts; org social telegram chats chatId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1842
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: chatId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/org/social/telegram/chats/:chatId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chats/:chatId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1131. GET /api/org/social/telegram/link/start

• Purpose: GET /api/org/social/telegram/link/start handled by socialLinking.ts; org social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1544
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1132. POST /api/org/social/telegram/unlink

• Purpose: POST /api/org/social/telegram/unlink handled by socialLinking.ts; org social telegram unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1578
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/telegram/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1133. GET /api/rego/friends

• Purpose: GET /api/rego/friends handled by social.ts; rego friends route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:250
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1134. DELETE /api/rego/friends/:id

• Purpose: DELETE /api/rego/friends/:id handled by social.ts; rego friends id route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:619
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/friends/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1135. PATCH /api/rego/friends/:id/accept

• Purpose: PATCH /api/rego/friends/:id/accept handled by social.ts; rego friends id accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:456
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/friends/:id/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/accept", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1136. POST /api/rego/friends/:id/block-everywhere

• Purpose: POST /api/rego/friends/:id/block-everywhere handled by social.ts; rego friends id block everywhere route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:743
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/friends/:id/block-everywhere" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/block-everywhere", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1137. PATCH /api/rego/friends/:id/decline

• Purpose: PATCH /api/rego/friends/:id/decline handled by social.ts; rego friends id decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:537
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/friends/:id/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/decline", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1138. POST /api/rego/friends/:id/unblock-everywhere

• Purpose: POST /api/rego/friends/:id/unblock-everywhere handled by social.ts; rego friends id unblock everywhere route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:768
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/friends/:id/unblock-everywhere" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/unblock-everywhere", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1139. GET /api/rego/friends/events

• Purpose: GET /api/rego/friends/events handled by social.ts; rego friends events route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:795
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1140. POST /api/rego/friends/request

• Purpose: POST /api/rego/friends/request handled by social.ts; rego friends request route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:368
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/friends/request" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/request", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1141. GET /api/rego/friends/requests

• Purpose: GET /api/rego/friends/requests handled by social.ts; rego friends requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:308
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/requests", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1142. GET /api/rego/friends/sent

• Purpose: GET /api/rego/friends/sent handled by social.ts; rego friends sent route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:338
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/sent" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/sent", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1143. GET /api/rego/friends/summary

• Purpose: GET /api/rego/friends/summary handled by social.ts; rego friends summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:221
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1144. GET /api/rego/social/discord/link/start

• Purpose: GET /api/rego/social/discord/link/start handled by socialLinking.ts; rego social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1346
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1145. POST /api/rego/social/discord/unlink

• Purpose: POST /api/rego/social/discord/unlink handled by socialLinking.ts; rego social discord unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1402
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/social/discord/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/discord/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1146. GET /api/rego/social/settings

• Purpose: GET /api/rego/social/settings handled by social.ts; rego social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:78
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1147. PATCH /api/rego/social/settings

• Purpose: PATCH /api/rego/social/settings handled by social.ts; rego social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:101
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1148. GET /api/rego/social/telegram/link/start

• Purpose: GET /api/rego/social/telegram/link/start handled by socialLinking.ts; rego social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1372
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1149. POST /api/rego/social/telegram/unlink

• Purpose: POST /api/rego/social/telegram/unlink handled by socialLinking.ts; rego social telegram unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1427
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/social/telegram/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/telegram/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1150. GET /api/rego/users/search

• Purpose: GET /api/rego/users/search handled by social.ts; rego users search route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:149
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1151. POST /api/rego/zep/launch

• Purpose: POST /api/rego/zep/launch handled by zep.ts; rego zep launch route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:695
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/zep/launch" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/zep/launch", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1152. GET /api/rego/zep/status

• Purpose: GET /api/rego/zep/status handled by zep.ts; rego zep status route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:680
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/zep/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/zep/status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1153. POST /api/zep/validate

• Purpose: POST /api/zep/validate handled by zep.ts; zep validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:728
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: publicApi
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/zep/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/zep/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1154. POST /hooks/telegram

• Purpose: POST /hooks/telegram handled by socialLinking.ts; hooks telegram route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1059
• Mounted prefix: /hooks
• Route module: socialLinking.ts
• Router variable: telegramWebhookRoutes
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/telegram" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/telegram", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

1155. POST /contact

• Purpose: POST /contact handled by contact.ts; contact route contract must be verified against source before integration.
• Source: partners-api/src/routes/contact.ts:28
• Mounted prefix: /contact
• Route module: contact.ts
• Router variable: contact
• Stability: public
• Authentication: Public route with validation and outbound mail behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/contact" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/contact", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/webhooks-and-contact/