Generated Route Inventory

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Inventory summary

• Generated at: 2026-08-18T14:33:35.423Z
• Route modules scanned: 61
• Mounted route declarations: 69
• Endpoint entries including aliases: 827
• Generated JSON: memory-bank/generated/partners-api-route-inventory.json
• Generated Markdown: memory-bank/generated/partners-api-route-inventory.md

Endpoint table

Method	Path	Module	Auth scan	Source
GET	/api/admin/attendees	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:116
GET	/api/admin/user-profiles	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:27
POST	/api/events	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/events/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/events/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/events/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/img/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:19
POST	/api/incidents	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:580
PUT	/api/incidents/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:619
PATCH	/api/incidents/:id/actions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:685
POST	/api/incidents/:id/cross-ban-decision	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:841
POST	/api/internal/test-runs	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1597
DELETE	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3025
POST	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2997
POST	/api/internal/test-runs/:runId/cleanup	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2831
POST	/api/internal/test-runs/:runId/dashboard-session	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1634
POST	/api/internal/test-runs/:runId/rego-sessions/bulk	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1662
DELETE	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2975
POST	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2946
POST	/api/internal/test-runs/:runId/seed/event	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2183
POST	/api/internal/test-runs/:runId/seed/social-graph	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2040
POST	/api/internal/test-runs/:runId/seed/staff	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1868
GET	/api/internal/test-runs/:runId/snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3047
POST	/api/internal/test-runs/:runId/state/fast-forward	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2748
POST	/api/internal/test-runs/:runId/suppress-side-effects	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2920
POST	/api/internal/test-runs/:runId/verify	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3066
POST	/api/internal/test-runs/sweep	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2879
POST	/api/manage	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/manage/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/manage/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/manage/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/partner-directory	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1184
POST	/api/pawsports/bind	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:478
GET	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:18
POST	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:77
DELETE	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:152
PUT	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:125
POST	/api/person-profiles/:id/links	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:171
DELETE	/api/person-profiles/:id/links/:reportId	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:204
GET	/api/platform-fees	rows.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rows.ts:1242
GET	/api/profile	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:47
PUT	/api/profile	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:177
GET	/api/profile/photo	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:92
PATCH	/api/profile/photo	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:110
GET	/api/rego/event-regos/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:521
GET	/api/rego/event-waitlist/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:651
POST	/api/rego/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:225
PATCH	/api/regos/:id/payment-status	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:710
POST	/api/regos/:regId/email	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:882
POST	/api/regos/:regId/email-preview	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:997
GET	/api/rows	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:116
GET	/api/spa/contracts	spaContracts.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/spaContracts.ts:72
POST	/api/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:224
POST	/api/watchlist/adoptions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:776
POST	/api/watchlist/grants	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:741
POST	/api/watchlist/master-requests	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:810
POST	/api/admin/discord/messages	adminDiscord.ts	Partner dashboard session required.	partners-api/src/routes/adminDiscord.ts:49
GET	/api/admin/discord/targets	adminDiscord.ts	Partner dashboard session required.	partners-api/src/routes/adminDiscord.ts:11
DELETE	/api/admin/events/:eventId/registrations	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:927
GET	/api/admin/members	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:182
POST	/api/admin/members	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:213
DELETE	/api/admin/members/:membershipId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:320
PATCH	/api/admin/members/:membershipId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:382
GET	/api/admin/notices	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:218
POST	/api/admin/notices	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:236
PATCH	/api/admin/notices/:id	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:350
GET	/api/admin/partners	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:62
POST	/api/admin/partners	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:77
PATCH	/api/admin/partners/:partnerId	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:120
POST	/api/admin/partners/:partnerId/cms-token	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:464
GET	/api/admin/platform-fee	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:575
PATCH	/api/admin/platform-fee	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:592
GET	/api/admin/platform-security	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:883
PATCH	/api/admin/platform-security	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:893
PUT	/api/admin/settlement-payment-providers	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:749
GET	/api/admin/settlement-settings	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:627
PATCH	/api/admin/settlement-settings	admin.ts	Partner dashboard session required.	partners-api/src/routes/admin.ts:665
GET	/api/network-bans/:watchlistEntryId	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:218
PATCH	/api/network-bans/:watchlistEntryId/appeal	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:522
POST	/api/network-bans/:watchlistEntryId/appeal	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:277
GET	/api/network-bans/:watchlistEntryId/appeal-status	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:357
GET	/api/network-bans/:watchlistEntryId/appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:417
GET	/api/network-bans/appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:14
POST	/api/network-bans/appeals/:appealId/decision	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:94
GET	/api/network-bans/my-appeals	networkBans.ts	Partner dashboard session required.	partners-api/src/routes/networkBans.ts:154
POST	/api/notices/:id/ack	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:192
GET	/api/notices/unacked	notices.ts	Partner dashboard session required.	partners-api/src/routes/notices.ts:133
GET	/api/org/settings	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:86
PATCH	/api/org/settings	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:113
POST	/api/org/settings/data-silo/backfill	orgSettings.ts	Partner dashboard session required.	partners-api/src/routes/orgSettings.ts:207
GET	/api/access	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:31
GET	/api/cms-token	access.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/access.ts:280
GET	/api/partner-directory	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:257
GET	/api/partner-permissions	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:177
PUT	/api/partner-permissions/members/:userId	access.ts	Partner dashboard session required.	partners-api/src/routes/access.ts:194
POST	/auth/accept-invite	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:797
POST	/auth/change-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:730
POST	/auth/dev-session	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:592
POST	/auth/exchange	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:698
GET	/auth/mfa/status	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:434
POST	/auth/mfa/totp/enroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:480
POST	/auth/mfa/totp/unenroll	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:554
POST	/auth/mfa/totp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:511
POST	/auth/otp/send	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:252
POST	/auth/otp/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:293
POST	/auth/passkey/authentication/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:335
POST	/auth/passkey/authentication/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:354
POST	/auth/passkey/registration/options	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:383
POST	/auth/passkey/registration/verify	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:404
POST	/auth/refresh	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:651
POST	/auth/reset-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:900
POST	/auth/set-password	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:926
POST	/auth/sign-in	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:224
POST	/auth/sign-out	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:766
POST	/auth/sign-up	auth.ts	Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.	partners-api/src/routes/auth.ts:872
POST	/hooks/send-email	authEmail.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/authEmail.ts:868
GET	/api/lan-system/releases/assets/:assetId	lanSystemReleases.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSystemReleases.ts:154
GET	/api/lan-system/releases/latest	lanSystemReleases.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSystemReleases.ts:99
GET	/api/events/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:610
PUT	/api/events/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:623
POST	/api/events/:id/activities/submissions/:submissionId/review	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:697
PUT	/api/events/:id/addons	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:572
PUT	/api/events/:id/check-in/:kind/:recordId	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2533
PUT	/api/events/:id/check-in/:kind/:recordId/claim	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2616
GET	/api/events/:id/check-in/entries	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2227
GET	/api/events/:id/check-in/entry	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2239
GET	/api/events/:id/check-in/offline-snapshot	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2375
GET	/api/events/:id/check-in/offline-snapshot/history	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2362
POST	/api/events/:id/check-in/offline-snapshot/import	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2496
POST	/api/events/:id/check-in/pawsport-lookup	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2262
GET	/api/events/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2189
PUT	/api/events/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2202
GET	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
GET	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
PUT	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
PUT	/api/events/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
GET	/api/events/:id/dealers-den/applications	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1148
DELETE	/api/events/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1130
GET	/api/events/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1179
POST	/api/events/:id/dealers-den/applications/:appId/approve	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1208
POST	/api/events/:id/dealers-den/applications/:appId/deny	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1301
POST	/api/events/:id/dealers-den/applications/:appId/request-changes	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1394
GET	/api/events/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:739
POST	/api/events/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:755
DELETE	/api/events/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:818
PUT	/api/events/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:797
PUT	/api/events/:id/dealers-den/packages/order	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:774
GET	/api/events/:id/dealers-den/regos	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:834
DELETE	/api/events/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:905
PATCH	/api/events/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:951
GET	/api/events/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:639
PUT	/api/events/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:682
GET	/api/events/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:196
PUT	/api/events/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:257
GET	/api/events/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1328
PUT	/api/events/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1359
POST	/api/events/:id/human-resources/applications/:applicationId/review	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1660
GET	/api/events/:id/human-resources/live-tracker	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1619
GET	/api/events/:id/human-resources/users/search	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1343
PUT	/api/events/:id/inclusions	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:346
GET	/api/events/:id/inventory	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1372
GET	/api/events/:id/inventory/movements	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1503
PUT	/api/events/:id/inventory/on-hand	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1419
POST	/api/events/:id/inventory/pos/quote	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1567
GET	/api/events/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1547
POST	/api/events/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1622
PUT	/api/events/:id/inventory/settings	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1386
POST	/api/events/:id/notifications/sample	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:54
GET	/api/events/:id/prefills	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:77
POST	/api/events/:id/prefills/:prefillId/revoke	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:115
GET	/api/events/:id/rego/analytics	regoAnalytics.ts	Partner dashboard session required.	partners-api/src/routes/regoAnalytics.ts:159
PUT	/api/events/:id/tiers	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:427
GET	/api/manage/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:610
PUT	/api/manage/:id/activities	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:623
POST	/api/manage/:id/activities/submissions/:submissionId/review	activities.ts	Partner dashboard session required.	partners-api/src/routes/activities.ts:697
PUT	/api/manage/:id/addons	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:572
PUT	/api/manage/:id/check-in/:kind/:recordId	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2533
PUT	/api/manage/:id/check-in/:kind/:recordId/claim	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2616
GET	/api/manage/:id/check-in/entries	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2227
GET	/api/manage/:id/check-in/entry	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2239
GET	/api/manage/:id/check-in/offline-snapshot	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2375
GET	/api/manage/:id/check-in/offline-snapshot/history	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2362
POST	/api/manage/:id/check-in/offline-snapshot/import	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2496
POST	/api/manage/:id/check-in/pawsport-lookup	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2262
GET	/api/manage/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2189
PUT	/api/manage/:id/check-in/settings	checkIn.ts	Partner dashboard session required.	partners-api/src/routes/checkIn.ts:2202
GET	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
GET	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:37
PUT	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
PUT	/api/manage/:id/conditions-of-entry	conditionsOfEntry.ts	Partner dashboard session required.	partners-api/src/routes/conditionsOfEntry.ts:77
GET	/api/manage/:id/dealers-den/applications	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1148
DELETE	/api/manage/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1130
GET	/api/manage/:id/dealers-den/applications/:appId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1179
POST	/api/manage/:id/dealers-den/applications/:appId/approve	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1208
POST	/api/manage/:id/dealers-den/applications/:appId/deny	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1301
POST	/api/manage/:id/dealers-den/applications/:appId/request-changes	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:1394
GET	/api/manage/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:739
POST	/api/manage/:id/dealers-den/packages	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:755
DELETE	/api/manage/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:818
PUT	/api/manage/:id/dealers-den/packages/:pkgId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:797
PUT	/api/manage/:id/dealers-den/packages/order	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:774
GET	/api/manage/:id/dealers-den/regos	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:834
DELETE	/api/manage/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:905
PATCH	/api/manage/:id/dealers-den/regos/:regoId	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:951
GET	/api/manage/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:639
PUT	/api/manage/:id/dealers-den/settings	dealersDen.ts	Partner dashboard session required.	partners-api/src/routes/dealersDen.ts:682
GET	/api/manage/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:196
PUT	/api/manage/:id/google-wallet-config	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:257
GET	/api/manage/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1328
PUT	/api/manage/:id/human-resources	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1359
POST	/api/manage/:id/human-resources/applications/:applicationId/review	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1660
GET	/api/manage/:id/human-resources/live-tracker	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1619
GET	/api/manage/:id/human-resources/users/search	humanResources.ts	Partner dashboard session required.	partners-api/src/routes/humanResources.ts:1343
PUT	/api/manage/:id/inclusions	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:346
GET	/api/manage/:id/inventory	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1372
GET	/api/manage/:id/inventory/movements	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1503
PUT	/api/manage/:id/inventory/on-hand	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1419
POST	/api/manage/:id/inventory/pos/quote	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1567
GET	/api/manage/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1547
POST	/api/manage/:id/inventory/pos/transactions	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1622
PUT	/api/manage/:id/inventory/settings	inventory.ts	Partner dashboard session required.	partners-api/src/routes/inventory.ts:1386
POST	/api/manage/:id/notifications/sample	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:54
GET	/api/manage/:id/prefills	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:77
POST	/api/manage/:id/prefills/:prefillId/revoke	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:115
GET	/api/manage/:id/rego/analytics	regoAnalytics.ts	Partner dashboard session required.	partners-api/src/routes/regoAnalytics.ts:159
PUT	/api/manage/:id/tiers	eventConfig.ts	Partner dashboard session required.	partners-api/src/routes/eventConfig.ts:427
GET	/api/rego/activities/submissions/my	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:929
GET	/api/rego/dealers-den/:eventId/info	dealersDen.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/dealersDen.ts:1492
POST	/api/rego/dealers-den/applications	dealersDen.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/dealersDen.ts:1735
DELETE	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1947
GET	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1685
PATCH	/api/rego/dealers-den/applications/:appId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1869
POST	/api/rego/dealers-den/applications/:appId/assistants	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1985
DELETE	/api/rego/dealers-den/applications/:appId/assistants/:aid	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2066
GET	/api/rego/dealers-den/applications/my	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1597
PATCH	/api/rego/dealers-den/assistants/:aid/respond	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2103
POST	/api/rego/dealers-den/events/:eventId/reserve	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2142
GET	/api/rego/dealers-den/regos/:regoId	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2648
GET	/api/rego/dealers-den/regos/:regoId/wallet	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2778
GET	/api/rego/dealers-den/regos/my	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:1617
POST	/api/rego/dealers-den/regos/submit	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2264
POST	/api/rego/dealers-den/reservations/:id/release	dealersDen.ts	Rego attendee session required.	partners-api/src/routes/dealersDen.ts:2242
GET	/api/rego/events/:slug/activities	activities.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/activities.ts:788
GET	/api/rego/events/:slug/activities/:activitySlug	activities.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/activities.ts:1032
POST	/api/rego/events/:slug/activities/:activitySlug/submissions	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:1087
GET	/api/rego/events/:slug/activities/submissions/my	activities.ts	Rego attendee session required.	partners-api/src/routes/activities.ts:841
GET	/api/rego/events/:slug/shift-authorizers	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:2165
POST	/api/rego/events/:slug/volunteer-applications	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:1844
GET	/api/rego/events/:slug/volunteer-opportunities	humanResources.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/humanResources.ts:1748
GET	/api/rego/human-resources/me	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:1982
POST	/api/rego/human-resources/shifts/:shiftId/track	humanResources.ts	Rego attendee session required.	partners-api/src/routes/humanResources.ts:2202
POST	/api/rego/notices/:id/ack	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:146
GET	/api/rego/notices/unacked	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:60
GET	/api/rego/notifications	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:193
POST	/api/rego/notifications/:id/read	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:280
POST	/api/rego/notifications/mark-all-read	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:308
GET	/api/rego/notifications/unread-count	regoNotices.ts	Rego attendee session required.	partners-api/src/routes/regoNotices.ts:256
GET	/api/rego/transactions/me	inventory.ts	Rego attendee session required.	partners-api/src/routes/inventory.ts:1730
POST	/api/events/:eventId/payment-accounts/:accountId/report	paymentAccountReports.ts	Rego attendee session required.	partners-api/src/routes/paymentAccountReports.ts:18
GET	/api/events/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:478
PUT	/api/events/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:493
GET	/api/events/:id/finance/accounting	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1022
POST	/api/events/:id/finance/accounting/deductions	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1190
POST	/api/events/:id/finance/accounting/entries	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1177
PATCH	/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1203
GET	/api/events/:id/finance/analytics	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:998
GET	/api/events/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1293
POST	/api/events/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1356
POST	/api/events/:id/finance/settlements/quote	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1319
GET	/api/events/:id/payment-account-reports	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:202
GET	/api/events/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:93
PUT	/api/events/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:117
GET	/api/events/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:125
PUT	/api/events/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:182
GET	/api/events/:id/rego-refunds	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:959
PATCH	/api/events/:id/rego-refunds/:refundId/review	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:981
GET	/api/events/:id/rego-transfers	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:928
PATCH	/api/events/:id/rego-transfers/:transferId/review	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:950
GET	/api/events/:id/rego-upgrades	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1332
PATCH	/api/events/:id/rego-upgrades/:upgradeId/review	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1396
POST	/api/manage/:eventId/payment-accounts/:accountId/report	paymentAccountReports.ts	Rego attendee session required.	partners-api/src/routes/paymentAccountReports.ts:18
GET	/api/manage/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:478
PUT	/api/manage/:id/finance-programs	financePrograms.ts	Partner dashboard session required.	partners-api/src/routes/financePrograms.ts:493
GET	/api/manage/:id/finance/accounting	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1022
POST	/api/manage/:id/finance/accounting/deductions	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1190
POST	/api/manage/:id/finance/accounting/entries	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1177
PATCH	/api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1203
GET	/api/manage/:id/finance/analytics	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:998
GET	/api/manage/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1293
POST	/api/manage/:id/finance/settlements	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1356
POST	/api/manage/:id/finance/settlements/quote	finance.ts	Partner dashboard session required.	partners-api/src/routes/finance.ts:1319
GET	/api/manage/:id/payment-account-reports	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:202
GET	/api/manage/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:93
PUT	/api/manage/:id/payment-accounts	paymentAccounts.ts	Partner dashboard session required.	partners-api/src/routes/paymentAccounts.ts:117
GET	/api/manage/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:125
PUT	/api/manage/:id/payment-providers	paymentProviders.ts	Partner dashboard session required.	partners-api/src/routes/paymentProviders.ts:182
GET	/api/manage/:id/rego-refunds	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:959
PATCH	/api/manage/:id/rego-refunds/:refundId/review	regoRefunds.ts	Partner dashboard session required.	partners-api/src/routes/regoRefunds.ts:981
GET	/api/manage/:id/rego-transfers	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:928
PATCH	/api/manage/:id/rego-transfers/:transferId/review	regoTransfers.ts	Partner dashboard session required.	partners-api/src/routes/regoTransfers.ts:950
GET	/api/manage/:id/rego-upgrades	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1332
PATCH	/api/manage/:id/rego-upgrades/:upgradeId/review	regoUpgrades.ts	Partner dashboard session required.	partners-api/src/routes/regoUpgrades.ts:1396
POST	/api/rego/rego-upgrades/:id/pay	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:1199
GET	/api/rego/regos/:ref/refunds	regoRefunds.ts	Rego attendee session required.	partners-api/src/routes/regoRefunds.ts:744
POST	/api/rego/regos/:ref/refunds	regoRefunds.ts	Rego attendee session required.	partners-api/src/routes/regoRefunds.ts:799
GET	/api/rego/regos/:ref/transfers	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:630
POST	/api/rego/regos/:ref/transfers	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:692
GET	/api/rego/regos/:ref/upgrades	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:945
POST	/api/rego/regos/:ref/upgrades	regoUpgrades.ts	Rego attendee session required.	partners-api/src/routes/regoUpgrades.ts:1034
GET	/api/rego/users/transfer-search	regoTransfers.ts	Rego attendee session required.	partners-api/src/routes/regoTransfers.ts:599
POST	/api/assets	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:863
GET	/api/assets/agreements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:804
POST	/api/assets/agreements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:819
GET	/api/assets/alerts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2085
GET	/api/assets/audits	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:576
POST	/api/assets/audits/:id/count-sheet/validate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2051
GET	/api/assets/audits/:id/results	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:594
GET	/api/assets/capabilities	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2397
PUT	/api/assets/capabilities/:key	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2411
GET	/api/assets/catalog	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:712
POST	/api/assets/catalog/categories	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:737
POST	/api/assets/catalog/models	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:754
GET	/api/assets/checkouts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:999
POST	/api/assets/checkouts	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:982
POST	/api/assets/checkouts/:id/acknowledge	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1033
GET	/api/assets/checkouts/:id/eligibility	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1045
POST	/api/assets/checkouts/:id/return	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1071
POST	/api/assets/containers/:id/pack	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1150
DELETE	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1912
GET	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1893
PUT	/api/assets/drafts/:workflowKey	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1902
GET	/api/assets/eligible-users	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:517
GET	/api/assets/evidence	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2280
POST	/api/assets/evidence	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2198
GET	/api/assets/evidence/:id/content	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2302
POST	/api/assets/evidence/:id/review	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2350
GET	/api/assets/finance/adapters/:format	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2383
GET	/api/assets/finance/context	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1219
GET	/api/assets/finance/rollforward	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1199
POST	/api/assets/finance/value-entries	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1231
GET	/api/assets/hub/overview	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1314
GET	/api/assets/hub/records	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1430
GET	/api/assets/hub/summary	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1331
GET	/api/assets/hub/tasks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1377
POST	/api/assets/hub/tasks/assign	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1694
POST	/api/assets/identifiers/issue	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:906
GET	/api/assets/imports/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2070
POST	/api/assets/imports/csv/validate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2030
GET	/api/assets/interoperability/epcis	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2010
GET	/api/assets/interoperability/snapshot	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2000
GET	/api/assets/items/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:552
POST	/api/assets/items/:id/activate	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:891
GET	/api/assets/loaned	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:475
GET	/api/assets/locations	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:677
POST	/api/assets/locations	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:691
GET	/api/assets/movements	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:839
GET	/api/assets/openapi.json	assets.ts	Partner dashboard session required.	partners-api/src/routes/assets.ts:375
GET	/api/assets/owned	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:474
GET	/api/assets/parties	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:771
POST	/api/assets/parties	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:785
GET	/api/assets/policies	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1979
POST	/api/assets/policies	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1921
GET	/api/assets/policies/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1971
POST	/api/assets/policies/:id/decision	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1961
POST	/api/assets/policies/:id/submit	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1951
GET	/api/assets/saved-views	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:477
POST	/api/assets/saved-views	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:491
DELETE	/api/assets/saved-views/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:505
POST	/api/assets/scan/resolve	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:931
GET	/api/assets/search	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:659
GET	/api/assets/settings/records	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1452
GET	/api/assets/shipments	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1109
POST	/api/assets/shipments	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1092
POST	/api/assets/shipments/:id/containers	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1131
POST	/api/assets/shipments/:id/dispatch	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1170
POST	/api/assets/shipments/:id/receive	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1184
GET	/api/assets/summary	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:380
GET	/api/assets/transit-exceptions	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:625
GET	/api/assets/webhooks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2122
POST	/api/assets/webhooks	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2099
PUT	/api/assets/webhooks/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2133
GET	/api/assets/webhooks/:id/deliveries	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2186
POST	/api/assets/webhooks/:id/test	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:2166
GET	/api/assets/work-orders	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:609
GET	/api/assets/work-orders/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:632
GET	/api/assets/workflow-cases	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1754
POST	/api/assets/workflow-cases	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1861
GET	/api/assets/workflow-cases/:id	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1796
POST	/api/assets/workflow-cases/:id/decision	assets.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/assets.ts:1826
GET	/api/attendee-accounts/lookup	attendeeAccounts.ts	Partner dashboard session required.	partners-api/src/routes/attendeeAccounts.ts:39
GET	/api/attendee-accounts/search	attendeeAccounts.ts	Partner dashboard session required.	partners-api/src/routes/attendeeAccounts.ts:25
GET	/api/events/:eventId/feedback-form	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:128
PUT	/api/events/:eventId/feedback-form/draft	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:142
POST	/api/events/:eventId/feedback-form/publish	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:202
POST	/api/events/:eventId/feedback-form/standard-template	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:176
GET	/api/events/:eventId/feedback-submissions	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:540
GET	/api/events/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:459
PATCH	/api/events/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:485
POST	/api/events/:eventId/feedback-submissions/:submissionId/notes	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:510
GET	/api/events/:eventId/feedback-submissions/export.csv	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:406
GET	/api/events/:eventId/forecasts	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:47
PATCH	/api/events/:eventId/forecasts/control	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:78
GET	/api/events/:eventId/lan-sync/changes	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:384
POST	/api/events/:eventId/lan-sync/evidence	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:285
GET	/api/events/:eventId/lan-sync/health	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:230
POST	/api/events/:eventId/lan-sync/operations	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:245
GET	/api/events/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:162
POST	/api/events/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:176
POST	/api/events/:eventId/lan-sync/sessions/:sessionId/revoke	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:213
GET	/api/events/:id/shop/cart	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1514
POST	/api/events/:id/shop/cart/items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1525
DELETE	/api/events/:id/shop/cart/items/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1565
POST	/api/events/:id/shop/cart/validate	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1584
POST	/api/events/:id/shop/categories	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1424
DELETE	/api/events/:id/shop/categories/:categoryId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1456
PUT	/api/events/:id/shop/categories/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1443
POST	/api/events/:id/shop/checkout	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1595
POST	/api/events/:id/shop/claim/lookup	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2397
GET	/api/events/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1283
POST	/api/events/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1294
POST	/api/events/:id/shop/couriers	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1478
POST	/api/events/:id/shop/couriers/:courierId/rates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1497
GET	/api/events/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1307
POST	/api/events/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1368
DELETE	/api/events/:id/shop/listings/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1401
PUT	/api/events/:id/shop/listings/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1388
GET	/api/events/:id/shop/my-orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1774
GET	/api/events/:id/shop/my-orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1789
POST	/api/events/:id/shop/my-orders/:orderId/payment	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1834
GET	/api/events/:id/shop/orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1901
GET	/api/events/:id/shop/orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2035
POST	/api/events/:id/shop/orders/:orderId/claim	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2229
POST	/api/events/:id/shop/orders/:orderId/claim-exception	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2304
POST	/api/events/:id/shop/orders/:orderId/payment-review	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2120
POST	/api/events/:id/shop/orders/:orderId/status	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2063
POST	/api/events/:id/shop/orders/:orderId/updates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2183
GET	/api/events/:id/shop/orders/dashboard	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1924
GET	/api/events/:id/shop/public	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1271
GET	/api/events/:id/shop/source-items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1319
GET	/api/geo/countries	geo.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/geo.ts:55
GET	/api/geo/states/:iso2	geo.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/geo.ts:69
GET	/api/manage/:eventId/feedback-form	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:128
PUT	/api/manage/:eventId/feedback-form/draft	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:142
POST	/api/manage/:eventId/feedback-form/publish	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:202
POST	/api/manage/:eventId/feedback-form/standard-template	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:176
GET	/api/manage/:eventId/feedback-submissions	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:540
GET	/api/manage/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:459
PATCH	/api/manage/:eventId/feedback-submissions/:submissionId	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:485
POST	/api/manage/:eventId/feedback-submissions/:submissionId/notes	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:510
GET	/api/manage/:eventId/feedback-submissions/export.csv	eventFeedback.ts	Partner dashboard session required.	partners-api/src/routes/eventFeedback.ts:406
GET	/api/manage/:eventId/forecasts	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:47
PATCH	/api/manage/:eventId/forecasts/control	forecasting.ts	Partner dashboard session required.	partners-api/src/routes/forecasting.ts:78
GET	/api/manage/:eventId/lan-sync/changes	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:384
POST	/api/manage/:eventId/lan-sync/evidence	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:285
GET	/api/manage/:eventId/lan-sync/health	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:230
POST	/api/manage/:eventId/lan-sync/operations	lanSync.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/lanSync.ts:245
GET	/api/manage/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:162
POST	/api/manage/:eventId/lan-sync/sessions	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:176
POST	/api/manage/:eventId/lan-sync/sessions/:sessionId/revoke	lanSync.ts	Partner dashboard session required.	partners-api/src/routes/lanSync.ts:213
GET	/api/manage/:id/shop/cart	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1514
POST	/api/manage/:id/shop/cart/items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1525
DELETE	/api/manage/:id/shop/cart/items/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1565
POST	/api/manage/:id/shop/cart/validate	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1584
POST	/api/manage/:id/shop/categories	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1424
DELETE	/api/manage/:id/shop/categories/:categoryId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1456
PUT	/api/manage/:id/shop/categories/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1443
POST	/api/manage/:id/shop/checkout	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1595
POST	/api/manage/:id/shop/claim/lookup	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2397
GET	/api/manage/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1283
POST	/api/manage/:id/shop/config	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1294
POST	/api/manage/:id/shop/couriers	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1478
POST	/api/manage/:id/shop/couriers/:courierId/rates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1497
GET	/api/manage/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1307
POST	/api/manage/:id/shop/listings	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1368
DELETE	/api/manage/:id/shop/listings/:listingId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1401
PUT	/api/manage/:id/shop/listings/order	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1388
GET	/api/manage/:id/shop/my-orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1774
GET	/api/manage/:id/shop/my-orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1789
POST	/api/manage/:id/shop/my-orders/:orderId/payment	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1834
GET	/api/manage/:id/shop/orders	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1901
GET	/api/manage/:id/shop/orders/:orderId	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2035
POST	/api/manage/:id/shop/orders/:orderId/claim	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2229
POST	/api/manage/:id/shop/orders/:orderId/claim-exception	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2304
POST	/api/manage/:id/shop/orders/:orderId/payment-review	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2120
POST	/api/manage/:id/shop/orders/:orderId/status	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2063
POST	/api/manage/:id/shop/orders/:orderId/updates	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:2183
GET	/api/manage/:id/shop/orders/dashboard	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1924
GET	/api/manage/:id/shop/public	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1271
GET	/api/manage/:id/shop/source-items	eventShop.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventShop.ts:1319
GET	/api/partners/:partnerId/finance/access	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:325
GET	/api/partners/:partnerId/finance/accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:347
GET	/api/partners/:partnerId/finance/audit	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1717
PUT	/api/partners/:partnerId/finance/cash-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:371
GET	/api/partners/:partnerId/finance/continuity-runs	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1383
POST	/api/partners/:partnerId/finance/continuity-runs	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1392
GET	/api/partners/:partnerId/finance/controls	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1374
GET	/api/partners/:partnerId/finance/counterparties	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:974
POST	/api/partners/:partnerId/finance/counterparties	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:991
GET	/api/partners/:partnerId/finance/custody-sessions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1199
POST	/api/partners/:partnerId/finance/custody-sessions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1208
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1275
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1295
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1253
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1229
POST	/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1317
GET	/api/partners/:partnerId/finance/default-payment-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:428
PUT	/api/partners/:partnerId/finance/default-payment-accounts	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:458
GET	/api/partners/:partnerId/finance/disbursements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:726
POST	/api/partners/:partnerId/finance/disbursements	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1509
POST	/api/partners/:partnerId/finance/disbursements/:requestId/actions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1550
POST	/api/partners/:partnerId/finance/entries	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:587
POST	/api/partners/:partnerId/finance/entries/:entryId/allocations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:642
POST	/api/partners/:partnerId/finance/entries/:entryId/reverse	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:623
GET	/api/partners/:partnerId/finance/events	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:669
POST	/api/partners/:partnerId/finance/evidence	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1054
POST	/api/partners/:partnerId/finance/evidence/:evidenceId/access	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1106
GET	/api/partners/:partnerId/finance/export.csv	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1743
GET	/api/partners/:partnerId/finance/history	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:499
GET	/api/partners/:partnerId/finance/history/:entryId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:554
GET	/api/partners/:partnerId/finance/imports	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:742
GET	/api/partners/:partnerId/finance/imports/:batchId/rows	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:752
GET	/api/partners/:partnerId/finance/integrations/health	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1336
POST	/api/partners/:partnerId/finance/integrations/profiles	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1353
GET	/api/partners/:partnerId/finance/interchange/export	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:854
GET	/api/partners/:partnerId/finance/interchange/profiles	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:834
POST	/api/partners/:partnerId/finance/interchange/ubl-invoice-preview	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:840
GET	/api/partners/:partnerId/finance/notifications/destinations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1638
PUT	/api/partners/:partnerId/finance/notifications/destinations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1652
GET	/api/partners/:partnerId/finance/notifications/discord-channels	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1621
GET	/api/partners/:partnerId/finance/notifications/options	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1598
GET	/api/partners/:partnerId/finance/periods	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:932
POST	/api/partners/:partnerId/finance/periods/:periodId/close	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:941
POST	/api/partners/:partnerId/finance/periods/:periodId/reopen	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:958
GET	/api/partners/:partnerId/finance/reconciliation-status	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:915
GET	/api/partners/:partnerId/finance/reconciliations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:881
POST	/api/partners/:partnerId/finance/reconciliations	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:890
POST	/api/partners/:partnerId/finance/reconciliations/import-preview	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:794
GET	/api/partners/:partnerId/finance/records	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1012
POST	/api/partners/:partnerId/finance/records	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1128
GET	/api/partners/:partnerId/finance/records/:recordId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1027
POST	/api/partners/:partnerId/finance/records/:recordId/actions	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1165
GET	/api/partners/:partnerId/finance/summary	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:331
POST	/api/partners/:partnerId/finance/work-locks	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1444
DELETE	/api/partners/:partnerId/finance/work-locks/:lockId	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1494
POST	/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat	partnerFinance.ts	Partner dashboard session required.	partners-api/src/routes/partnerFinance.ts:1479
GET	/api/partners/:partnerId/operations-linkage/access	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:513
GET	/api/partners/:partnerId/operations-linkage/coverage	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:519
GET	/api/partners/:partnerId/operations-linkage/deployments	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1023
POST	/api/partners/:partnerId/operations-linkage/deployments	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1053
GET	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1111
POST	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1234
GET	/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1178
GET	/api/partners/:partnerId/operations-linkage/dimensions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:782
POST	/api/partners/:partnerId/operations-linkage/dimensions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:878
POST	/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:970
GET	/api/partners/:partnerId/operations-linkage/exceptions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1505
POST	/api/partners/:partnerId/operations-linkage/exceptions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1539
GET	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1524
POST	/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1598
GET	/api/partners/:partnerId/operations-linkage/finance/asset-batches	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1400
POST	/api/partners/:partnerId/operations-linkage/finance/asset-batches	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1413
POST	/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1448
GET	/api/partners/:partnerId/operations-linkage/finance/coding-proposals	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1313
POST	/api/partners/:partnerId/operations-linkage/finance/coding-proposals	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1326
POST	/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1363
GET	/api/partners/:partnerId/operations-linkage/links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:606
POST	/api/partners/:partnerId/operations-linkage/links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:652
PATCH	/api/partners/:partnerId/operations-linkage/links/:linkId	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:756
POST	/api/partners/:partnerId/operations-linkage/links/:linkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:755
GET	/api/partners/:partnerId/operations-linkage/links/candidates	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:625
GET	/api/partners/:partnerId/operations-linkage/parties	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:780
POST	/api/partners/:partnerId/operations-linkage/parties	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:808
POST	/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:968
POST	/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1020
GET	/api/partners/:partnerId/operations-linkage/places	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:781
POST	/api/partners/:partnerId/operations-linkage/places	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:842
POST	/api/partners/:partnerId/operations-linkage/places/:placeId/system-links	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:969
POST	/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1021
GET	/api/partners/:partnerId/operations-linkage/search	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1647
GET	/api/partners/:partnerId/operations-linkage/timeline	operationsLinkage.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/operationsLinkage.ts:1719
GET	/api/pawsports	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:392
DELETE	/api/pawsports/:id	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:878
PATCH	/api/pawsports/:id	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:808
POST	/api/pawsports/:id/notes	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:894
DELETE	/api/pawsports/:id/notes/:noteId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:963
PATCH	/api/pawsports/:id/notes/:noteId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:929
POST	/api/pawsports/:id/reassign	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:1054
POST	/api/pawsports/:id/reissue	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:633
POST	/api/pawsports/:id/restore	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:981
POST	/api/pawsports/:id/revoke	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:600
POST	/api/pawsports/:id/stamps	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:752
DELETE	/api/pawsports/:id/stamps/:stampId	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:790
POST	/api/pawsports/:id/unbind	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:1022
GET	/api/pawsports/attendees/lookup	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:357
POST	/api/pawsports/bind	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:596
POST	/api/pawsports/issue	pawsports.ts	Partner dashboard session required.	partners-api/src/routes/pawsports.ts:481
GET	/api/planning/artifacts/:artifactId/content	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2541
GET	/api/planning/meta	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:945
GET	/api/planning/my-work	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1058
GET	/api/planning/openapi.json	planning.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planning.ts:109
GET	/api/planning/projects	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:954
POST	/api/planning/projects	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:986
GET	/api/planning/projects/:projectId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1425
PATCH	/api/planning/projects/:projectId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1694
POST	/api/planning/projects/:projectId/:collection	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3155
PATCH	/api/planning/projects/:projectId/:collection/:resourceId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3201
POST	/api/planning/projects/:projectId/agenda-templates	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2953
POST	/api/planning/projects/:projectId/artifacts	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2474
PATCH	/api/planning/projects/:projectId/artifacts/:artifactId/controls	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2595
POST	/api/planning/projects/:projectId/artifacts/:artifactId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2577
POST	/api/planning/projects/:projectId/artifacts/:artifactId/versions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2522
GET	/api/planning/projects/:projectId/audit	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3041
POST	/api/planning/projects/:projectId/baselines	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1996
GET	/api/planning/projects/:projectId/bootstrap	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1217
GET	/api/planning/projects/:projectId/calendar.ics	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1588
GET	/api/planning/projects/:projectId/calendar.jscalendar	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1653
POST	/api/planning/projects/:projectId/canonical-command	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2390
GET	/api/planning/projects/:projectId/change-sets	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2276
POST	/api/planning/projects/:projectId/change-sets	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2292
POST	/api/planning/projects/:projectId/change-sets/:changeSetId/apply	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2383
POST	/api/planning/projects/:projectId/change-sets/:changeSetId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2346
POST	/api/planning/projects/:projectId/comments	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3052
PUT	/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3077
GET	/api/planning/projects/:projectId/decision-participants	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2802
GET	/api/planning/projects/:projectId/delivery-history	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:740
POST	/api/planning/projects/:projectId/departments/:departmentId/memberships	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2859
POST	/api/planning/projects/:projectId/dependencies	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1849
DELETE	/api/planning/projects/:projectId/dependencies/:dependencyId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2028
POST	/api/planning/projects/:projectId/destinations	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2418
POST	/api/planning/projects/:projectId/destinations/:destinationId/rotate	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2930
POST	/api/planning/projects/:projectId/destinations/:destinationId/test	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2457
GET	/api/planning/projects/:projectId/event-catalog	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1739
POST	/api/planning/projects/:projectId/exercises	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2973
POST	/api/planning/projects/:projectId/gates/:gateId/decisions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3001
POST	/api/planning/projects/:projectId/handoffs	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3019
GET	/api/planning/projects/:projectId/handoffs/:handoffId/export	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3035
POST	/api/planning/projects/:projectId/imports	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3129
POST	/api/planning/projects/:projectId/link-event	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1719
GET	/api/planning/projects/:projectId/meetings/:meetingId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1674
POST	/api/planning/projects/:projectId/meetings/:meetingId/agenda	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2139
POST	/api/planning/projects/:projectId/meetings/:meetingId/agenda/state	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2166
POST	/api/planning/projects/:projectId/meetings/:meetingId/minutes	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2172
POST	/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2199
POST	/api/planning/projects/:projectId/meetings/:meetingId/notes	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3093
PUT	/api/planning/projects/:projectId/meetings/:meetingId/rsvp	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3084
GET	/api/planning/projects/:projectId/member-directory	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2766
GET	/api/planning/projects/:projectId/my-reminder-channels	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:276
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:408
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:411
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:431
POST	/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:409
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:709
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/resend	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:615
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:610
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:698
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:719
POST	/api/planning/projects/:projectId/my-reminder-channels/sms/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:633
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:284
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:338
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:358
POST	/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:329
POST	/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:769
POST	/api/planning/projects/:projectId/notification-outbox/:outboxId/retry	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:754
PUT	/api/planning/projects/:projectId/notification-preferences	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3104
POST	/api/planning/projects/:projectId/notification-rules	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2014
GET	/api/planning/projects/:projectId/pages/:collection	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1258
POST	/api/planning/projects/:projectId/requirement-packs/instantiate	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2898
POST	/api/planning/projects/:projectId/requirement-templates	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2888
PUT	/api/planning/projects/:projectId/requirements/:requirementId/approval-flow	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2686
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2082
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2629
POST	/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2131
GET	/api/planning/projects/:projectId/requirements/:requirementId/work-items	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2042
POST	/api/planning/projects/:projectId/requirements/:requirementId/work-items	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2058
POST	/api/planning/projects/:projectId/resource-links	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1798
DELETE	/api/planning/projects/:projectId/resource-links/:linkId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1834
POST	/api/planning/projects/:projectId/risks/:riskId/lifecycle	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2729
POST	/api/planning/projects/:projectId/saved-views	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3118
DELETE	/api/planning/projects/:projectId/saved-views/:viewId	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3124
GET	/api/planning/projects/:projectId/schedule-window	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1346
POST	/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token	planningReminderChannels.ts	Partner dashboard session required.	partners-api/src/routes/planningReminderChannels.ts:779
GET	/api/planning/projects/:projectId/usernames/search	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:2826
PUT	/api/planning/projects/:projectId/watchers	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:3068
POST	/api/planning/projects/:projectId/work-items/:workItemId/reschedule	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1895
POST	/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1935
POST	/api/planning/projects/:projectId/work-items/:workItemId/wbs-position	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1960
GET	/api/planning/projects/:projectId/workload-window	planning.ts	Partner dashboard session required.	partners-api/src/routes/planning.ts:1381
POST	/api/planning/sms-gateway/devices/:deviceId/heartbeat	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:849
POST	/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:1014
POST	/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:964
POST	/api/planning/sms-gateway/devices/:deviceId/lease	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:873
GET	/api/planning/sms-gateway/devices/:deviceId/preflight	planningReminderChannels.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/planningReminderChannels.ts:834
GET	/api/rego/events/:slug/feedback	eventFeedback.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventFeedback.ts:239
POST	/api/rego/events/:slug/feedback/submissions	eventFeedback.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/eventFeedback.ts:276
GET	/api/rego/pawsport	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1280
POST	/api/rego/pawsport/:id/lost	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1230
POST	/api/rego/pawsport/enroll	pawsports.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/pawsports.ts:1134
GET	/api/social-publishing/oauth/:network/callback	socialPublishing.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/socialPublishing.ts:191
POST	/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:164
POST	/api/social-publishing/partners/:partnerId/accounts/discord-webhook	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:271
POST	/api/social-publishing/partners/:partnerId/accounts/telegram	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:294
GET	/api/social-publishing/partners/:partnerId/overview	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:237
POST	/api/social-publishing/partners/:partnerId/posts	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:315
POST	/api/social-publishing/partners/:partnerId/posts/:postId/queue	socialPublishing.ts	Partner dashboard session required.	partners-api/src/routes/socialPublishing.ts:394
POST	/hooks/discord-finance	financeInteractions.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/financeInteractions.ts:31
GET	/api/events/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:819
PUT	/api/events/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:843
GET	/api/events/:id/rego-gifts	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:1925
POST	/api/events/:id/rego-gifts/:giftId/payment-review	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:1947
POST	/api/events/:id/reserve-slot	regoReservations.ts	Partner dashboard session required.	partners-api/src/routes/regoReservations.ts:20
GET	/api/events/:id/waitlist-config	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:263
PUT	/api/events/:id/waitlist-config/:subjectType/:subjectId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:298
POST	/api/events/:id/waitlist/process-next/:tierId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:388
POST	/api/internal/waitlist/expire-offers	waitlist.ts	Internal cron secret required.	partners-api/src/routes/waitlist.ts:654
GET	/api/manage/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:819
PUT	/api/manage/:id/group-rego-settings	groupRego.ts	Partner dashboard session required.	partners-api/src/routes/groupRego.ts:843
GET	/api/manage/:id/rego-gifts	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:1925
POST	/api/manage/:id/rego-gifts/:giftId/payment-review	rego.ts	Partner dashboard session required.	partners-api/src/routes/rego.ts:1947
POST	/api/manage/:id/reserve-slot	regoReservations.ts	Partner dashboard session required.	partners-api/src/routes/regoReservations.ts:20
GET	/api/manage/:id/waitlist-config	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:263
PUT	/api/manage/:id/waitlist-config/:subjectType/:subjectId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:298
POST	/api/manage/:id/waitlist/process-next/:tierId	waitlist.ts	Partner dashboard session required.	partners-api/src/routes/waitlist.ts:388
POST	/api/rego-reservations/:id/release	regoReservations.ts	Rego attendee session required.	partners-api/src/routes/regoReservations.ts:92
GET	/api/rego/affiliate-rewards	regoAffiliateRewards.ts	Rego attendee session required.	partners-api/src/routes/regoAffiliateRewards.ts:18
PUT	/api/rego/affiliate-rewards/:affiliateId/payout	regoAffiliateRewards.ts	Rego attendee session required.	partners-api/src/routes/regoAffiliateRewards.ts:30
GET	/api/rego/events	rego.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rego.ts:1023
GET	/api/rego/events/:slug	rego.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rego.ts:1112
GET	/api/rego/events/:slug/gift/recipient	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1450
GET	/api/rego/fursonas	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:69
POST	/api/rego/fursonas	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:90
DELETE	/api/rego/fursonas/:id	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:195
PUT	/api/rego/fursonas/:id	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:136
DELETE	/api/rego/fursonas/:id/refs	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:282
POST	/api/rego/fursonas/:id/refs	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:232
PUT	/api/rego/fursonas/:id/refs/latest	fursonas.ts	Rego attendee session required.	partners-api/src/routes/fursonas.ts:332
POST	/api/rego/gifts	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1570
GET	/api/rego/gifts/:id	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1894
POST	/api/rego/gifts/:id/redeem	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1917
GET	/api/rego/gifts/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1870
POST	/api/rego/gifts/quote	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1499
POST	/api/rego/groups	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:245
GET	/api/rego/groups/:id	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:397
PATCH	/api/rego/groups/:id/accept	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:552
PATCH	/api/rego/groups/:id/cancel	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:566
PATCH	/api/rego/groups/:id/decline	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:559
POST	/api/rego/groups/:id/invite	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:440
DELETE	/api/rego/groups/:id/members/:memberId	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:648
PATCH	/api/rego/groups/:id/members/:memberId	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:598
POST	/api/rego/groups/:id/submit	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:3160
GET	/api/rego/groups/:id/totals	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:685
GET	/api/rego/groups/my	groupRego.ts	Rego attendee session required.	partners-api/src/routes/groupRego.ts:339
POST	/api/rego/internal/archive-expired	rego.ts	Internal cron secret required.	partners-api/src/routes/rego.ts:4059
POST	/api/rego/payment-link-reference	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:1283
PUT	/api/rego/prefills	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:2051
DELETE	/api/rego/prefills/:eventId	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2270
GET	/api/rego/prefills/:eventId	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2015
GET	/api/rego/profile	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:173
PUT	/api/rego/profile	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:273
PATCH	/api/rego/profile/email-preferences	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:385
GET	/api/rego/profile/import-dashboard	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:199
POST	/api/rego/profile/phone/validate	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:263
GET	/api/rego/profile/photo	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:486
PATCH	/api/rego/profile/photo	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:505
PATCH	/api/rego/profile/username	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:451
POST	/api/rego/quote	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:1358
POST	/api/rego/regos	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:2620
GET	/api/rego/regos/:ref	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2361
GET	/api/rego/regos/:ref/wallet	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2550
GET	/api/rego/regos/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:2296
GET	/api/rego/username/check	regoProfile.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/regoProfile.ts:433
POST	/api/rego/waitlist	rego.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/rego.ts:3969
POST	/api/rego/waitlist/:entryId/accept	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:553
POST	/api/rego/waitlist/:entryId/decline	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:470
GET	/api/rego/waitlist/me	rego.ts	Rego attendee session required.	partners-api/src/routes/rego.ts:3927
GET	/api/rego/waitlist/pending-offer	waitlist.ts	Rego attendee session required.	partners-api/src/routes/waitlist.ts:413
GET	/api/events/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1862
PATCH	/api/events/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1903
GET	/api/events/:id/social/discord/guilds	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1744
GET	/api/events/:id/social/discord/guilds/:guildId/roles	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1765
GET	/api/events/:id/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1668
GET	/api/events/:id/social/telegram/chats	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1801
POST	/api/events/:id/social/telegram/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1929
GET	/api/events/:id/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1698
GET	/api/events/:id/zep/app-bundle	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:484
GET	/api/events/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:422
PUT	/api/events/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:501
POST	/api/internal/social-entitlements/reconcile	socialLinking.ts	Internal cron secret required.	partners-api/src/routes/socialLinking.ts:2288
GET	/api/manage/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1862
PATCH	/api/manage/:id/social/bot-settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1903
GET	/api/manage/:id/social/discord/guilds	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1744
GET	/api/manage/:id/social/discord/guilds/:guildId/roles	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1765
GET	/api/manage/:id/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1668
GET	/api/manage/:id/social/telegram/chats	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1801
POST	/api/manage/:id/social/telegram/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1929
GET	/api/manage/:id/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1698
GET	/api/manage/:id/zep/app-bundle	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:484
GET	/api/manage/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:422
PUT	/api/manage/:id/zep/config	zep.ts	Partner dashboard session required.	partners-api/src/routes/zep.ts:501
DELETE	/api/org/social/discord/guilds/:guildId	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1822
GET	/api/org/social/discord/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1492
POST	/api/org/social/discord/unlink	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1522
GET	/api/org/social/settings	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1452
POST	/api/org/social/telegram/chat/link/complete	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1642
GET	/api/org/social/telegram/chat/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1600
DELETE	/api/org/social/telegram/chats/:chatId	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1842
GET	/api/org/social/telegram/link/start	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1544
POST	/api/org/social/telegram/unlink	socialLinking.ts	Partner dashboard session required.	partners-api/src/routes/socialLinking.ts:1578
GET	/api/rego/friends	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:183
DELETE	/api/rego/friends/:id	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:559
PATCH	/api/rego/friends/:id/accept	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:418
PATCH	/api/rego/friends/:id/decline	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:488
GET	/api/rego/friends/events	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:673
POST	/api/rego/friends/request	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:301
GET	/api/rego/friends/requests	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:241
GET	/api/rego/friends/sent	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:271
GET	/api/rego/social/discord/link/start	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1346
POST	/api/rego/social/discord/unlink	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1402
GET	/api/rego/social/settings	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:58
PATCH	/api/rego/social/settings	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:81
GET	/api/rego/social/telegram/link/start	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1372
POST	/api/rego/social/telegram/unlink	socialLinking.ts	Rego attendee session required.	partners-api/src/routes/socialLinking.ts:1427
GET	/api/rego/users/search	social.ts	Rego attendee session required.	partners-api/src/routes/social.ts:129
POST	/api/rego/zep/launch	zep.ts	Rego attendee session required.	partners-api/src/routes/zep.ts:695
GET	/api/rego/zep/status	zep.ts	Rego attendee session required.	partners-api/src/routes/zep.ts:680
POST	/api/zep/validate	zep.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/zep.ts:728
POST	/hooks/telegram	socialLinking.ts	Webhook/internal route; inspect signature or shared secret verification before use.	partners-api/src/routes/socialLinking.ts:1059
POST	/contact	contact.ts	Public route with validation and outbound mail behavior.	partners-api/src/routes/contact.ts:28

Endpoint contracts

1. GET /api/admin/attendees

• Purpose: GET /api/admin/attendees handled by staffProfiles.ts; admin attendees route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:116
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/attendees" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/attendees", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

2. GET /api/admin/user-profiles

• Purpose: GET /api/admin/user-profiles handled by staffProfiles.ts; admin user profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/staffProfiles.ts:27
• Mounted prefix: /api
• Route module: staffProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/user-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/user-profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

3. POST /api/events

• Purpose: POST /api/events handled by mutations.ts; events route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:159
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

4. GET /api/events/:id

• Purpose: GET /api/events/:id handled by rows.ts; events id route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:399
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

5. PUT /api/events/:id

• Purpose: PUT /api/events/:id handled by mutations.ts; events id route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:245
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

6. GET /api/events/check-rego-ref-prefix

• Purpose: GET /api/events/check-rego-ref-prefix handled by mutations.ts; events check rego ref prefix route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:204
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/check-rego-ref-prefix" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/check-rego-ref-prefix", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

7. GET /api/img/:filename

• Purpose: GET /api/img/:filename handled by imgProxy.ts; img filename route contract must be verified against source before integration.
• Source: partners-api/src/routes/imgProxy.ts:19
• Mounted prefix: /api
• Route module: imgProxy.ts
• Router variable: router
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: filename
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/img/:filename" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/img/:filename", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

8. POST /api/incidents

• Purpose: POST /api/incidents handled by mutations.ts; incidents route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:580
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/incidents" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

9. PUT /api/incidents/:id

• Purpose: PUT /api/incidents/:id handled by mutations.ts; incidents id route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:619
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/incidents/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

10. PATCH /api/incidents/:id/actions

• Purpose: PATCH /api/incidents/:id/actions handled by mutations.ts; incidents id actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:685
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/incidents/:id/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id/actions", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

11. POST /api/incidents/:id/cross-ban-decision

• Purpose: POST /api/incidents/:id/cross-ban-decision handled by mutations.ts; incidents id cross ban decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:841
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/incidents/:id/cross-ban-decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/incidents/:id/cross-ban-decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

12. POST /api/internal/test-runs

• Purpose: POST /api/internal/test-runs handled by testRuns.ts; internal test runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1597
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

13. DELETE /api/internal/test-runs/:runId/assets

• Purpose: DELETE /api/internal/test-runs/:runId/assets handled by testRuns.ts; internal test runs runId assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3025
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/internal/test-runs/:runId/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/assets", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

14. POST /api/internal/test-runs/:runId/assets

• Purpose: POST /api/internal/test-runs/:runId/assets handled by testRuns.ts; internal test runs runId assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2997
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/assets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

15. POST /api/internal/test-runs/:runId/cleanup

• Purpose: POST /api/internal/test-runs/:runId/cleanup handled by testRuns.ts; internal test runs runId cleanup route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2831
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/cleanup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/cleanup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

16. POST /api/internal/test-runs/:runId/dashboard-session

• Purpose: POST /api/internal/test-runs/:runId/dashboard-session handled by testRuns.ts; internal test runs runId dashboard session route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1634
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/dashboard-session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/dashboard-session", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

17. POST /api/internal/test-runs/:runId/rego-sessions/bulk

• Purpose: POST /api/internal/test-runs/:runId/rego-sessions/bulk handled by testRuns.ts; internal test runs runId rego sessions bulk route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1662
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/rego-sessions/bulk" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/rego-sessions/bulk", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

18. DELETE /api/internal/test-runs/:runId/roots

• Purpose: DELETE /api/internal/test-runs/:runId/roots handled by testRuns.ts; internal test runs runId roots route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2975
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/internal/test-runs/:runId/roots" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/roots", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

19. POST /api/internal/test-runs/:runId/roots

• Purpose: POST /api/internal/test-runs/:runId/roots handled by testRuns.ts; internal test runs runId roots route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2946
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/roots" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/roots", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

20. POST /api/internal/test-runs/:runId/seed/event

• Purpose: POST /api/internal/test-runs/:runId/seed/event handled by testRuns.ts; internal test runs runId seed event route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2183
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/event" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/event", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

21. POST /api/internal/test-runs/:runId/seed/social-graph

• Purpose: POST /api/internal/test-runs/:runId/seed/social-graph handled by testRuns.ts; internal test runs runId seed social graph route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2040
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/social-graph" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/social-graph", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

22. POST /api/internal/test-runs/:runId/seed/staff

• Purpose: POST /api/internal/test-runs/:runId/seed/staff handled by testRuns.ts; internal test runs runId seed staff route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:1868
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/seed/staff" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/seed/staff", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

23. GET /api/internal/test-runs/:runId/snapshot

• Purpose: GET /api/internal/test-runs/:runId/snapshot handled by testRuns.ts; internal test runs runId snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3047
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/internal/test-runs/:runId/snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

24. POST /api/internal/test-runs/:runId/state/fast-forward

• Purpose: POST /api/internal/test-runs/:runId/state/fast-forward handled by testRuns.ts; internal test runs runId state fast forward route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2748
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/state/fast-forward" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/state/fast-forward", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

25. POST /api/internal/test-runs/:runId/suppress-side-effects

• Purpose: POST /api/internal/test-runs/:runId/suppress-side-effects handled by testRuns.ts; internal test runs runId suppress side effects route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2920
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/suppress-side-effects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/suppress-side-effects", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

26. POST /api/internal/test-runs/:runId/verify

• Purpose: POST /api/internal/test-runs/:runId/verify handled by testRuns.ts; internal test runs runId verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:3066
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: runId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/:runId/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/:runId/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

27. POST /api/internal/test-runs/sweep

• Purpose: POST /api/internal/test-runs/sweep handled by testRuns.ts; internal test runs sweep route contract must be verified against source before integration.
• Source: partners-api/src/routes/testRuns.ts:2879
• Mounted prefix: /api
• Route module: testRuns.ts
• Router variable: api
• Stability: test-only-or-certification
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/test-runs/sweep" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/test-runs/sweep", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

28. POST /api/manage

• Purpose: POST /api/manage is the Event Management compatibility alias for /api/events.
• Source: partners-api/src/routes/mutations.ts:159
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

29. GET /api/manage/:id

• Purpose: GET /api/manage/:id is the Event Management compatibility alias for /api/events/:id.
• Source: partners-api/src/routes/rows.ts:399
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

30. PUT /api/manage/:id

• Purpose: PUT /api/manage/:id is the Event Management compatibility alias for /api/events/:id.
• Source: partners-api/src/routes/mutations.ts:245
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

31. GET /api/manage/check-rego-ref-prefix

• Purpose: GET /api/manage/check-rego-ref-prefix is the Event Management compatibility alias for /api/events/check-rego-ref-prefix.
• Source: partners-api/src/routes/mutations.ts:204
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/check-rego-ref-prefix" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/check-rego-ref-prefix", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

32. GET /api/partner-directory

• Purpose: GET /api/partner-directory handled by rows.ts; partner directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:1184
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

33. POST /api/pawsports/bind

• Purpose: POST /api/pawsports/bind handled by mutations.ts; pawsports bind route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:478
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/bind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/bind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

34. GET /api/person-profiles

• Purpose: GET /api/person-profiles handled by personProfiles.ts; person profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:18
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/person-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

35. POST /api/person-profiles

• Purpose: POST /api/person-profiles handled by personProfiles.ts; person profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:77
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/person-profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

36. DELETE /api/person-profiles/:id

• Purpose: DELETE /api/person-profiles/:id handled by personProfiles.ts; person profiles id route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:152
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/person-profiles/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

37. PUT /api/person-profiles/:id

• Purpose: PUT /api/person-profiles/:id handled by personProfiles.ts; person profiles id route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:125
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/person-profiles/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

38. POST /api/person-profiles/:id/links

• Purpose: POST /api/person-profiles/:id/links handled by personProfiles.ts; person profiles id links route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:171
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/person-profiles/:id/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id/links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

39. DELETE /api/person-profiles/:id/links/:reportId

• Purpose: DELETE /api/person-profiles/:id/links/:reportId handled by personProfiles.ts; person profiles id links reportId route contract must be verified against source before integration.
• Source: partners-api/src/routes/personProfiles.ts:204
• Mounted prefix: /api
• Route module: personProfiles.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, reportId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/person-profiles/:id/links/:reportId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/person-profiles/:id/links/:reportId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

40. GET /api/platform-fees

• Purpose: GET /api/platform-fees handled by rows.ts; platform fees route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:1242
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/platform-fees" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/platform-fees", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

41. GET /api/profile

• Purpose: GET /api/profile handled by profile.ts; profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/profile.ts:47
• Mounted prefix: /api
• Route module: profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/profile", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

42. PUT /api/profile

• Purpose: PUT /api/profile handled by profile.ts; profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/profile.ts:177
• Mounted prefix: /api
• Route module: profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/profile", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

43. GET /api/profile/photo

• Purpose: GET /api/profile/photo handled by profile.ts; profile photo route contract must be verified against source before integration.
• Source: partners-api/src/routes/profile.ts:92
• Mounted prefix: /api
• Route module: profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/profile/photo" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/profile/photo", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

44. PATCH /api/profile/photo

• Purpose: PATCH /api/profile/photo handled by profile.ts; profile photo route contract must be verified against source before integration.
• Source: partners-api/src/routes/profile.ts:110
• Mounted prefix: /api
• Route module: profile.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/profile/photo" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/profile/photo", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

45. GET /api/rego/event-regos/:eventId

• Purpose: GET /api/rego/event-regos/:eventId handled by rows.ts; rego event regos eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:521
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/event-regos/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/event-regos/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

46. GET /api/rego/event-waitlist/:eventId

• Purpose: GET /api/rego/event-waitlist/:eventId handled by rows.ts; rego event waitlist eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:651
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/event-waitlist/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/event-waitlist/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

47. POST /api/rego/upload-image

• Purpose: POST /api/rego/upload-image handled by uploadImage.ts; rego upload image route contract must be verified against source before integration.
• Source: partners-api/src/routes/uploadImage.ts:225
• Mounted prefix: /api
• Route module: uploadImage.ts
• Router variable: app
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/upload-image" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/upload-image", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

48. PATCH /api/regos/:id/payment-status

• Purpose: PATCH /api/regos/:id/payment-status handled by rows.ts; regos id payment status route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:710
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/regos/:id/payment-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:id/payment-status", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

49. POST /api/regos/:regId/email

• Purpose: POST /api/regos/:regId/email handled by rows.ts; regos regId email route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:882
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/regos/:regId/email" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:regId/email", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

50. POST /api/regos/:regId/email-preview

• Purpose: POST /api/regos/:regId/email-preview handled by rows.ts; regos regId email preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:997
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/regos/:regId/email-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/regos/:regId/email-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

51. GET /api/rows

• Purpose: GET /api/rows handled by rows.ts; rows route contract must be verified against source before integration.
• Source: partners-api/src/routes/rows.ts:116
• Mounted prefix: /api
• Route module: rows.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rows" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rows", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

52. GET /api/spa/contracts

• Purpose: GET /api/spa/contracts handled by spaContracts.ts; spa contracts route contract must be verified against source before integration.
• Source: partners-api/src/routes/spaContracts.ts:72
• Mounted prefix: /api
• Route module: spaContracts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/spa/contracts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/spa/contracts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

53. POST /api/upload-image

• Purpose: POST /api/upload-image handled by uploadImage.ts; upload image route contract must be verified against source before integration.
• Source: partners-api/src/routes/uploadImage.ts:224
• Mounted prefix: /api
• Route module: uploadImage.ts
• Router variable: app
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May read or write media/storage assets.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/upload-image" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/upload-image", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

54. POST /api/watchlist/adoptions

• Purpose: POST /api/watchlist/adoptions handled by mutations.ts; watchlist adoptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:776
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/adoptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/adoptions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

55. POST /api/watchlist/grants

• Purpose: POST /api/watchlist/grants handled by mutations.ts; watchlist grants route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:741
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/grants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/grants", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

56. POST /api/watchlist/master-requests

• Purpose: POST /api/watchlist/master-requests handled by mutations.ts; watchlist master requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/mutations.ts:810
• Mounted prefix: /api
• Route module: mutations.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/watchlist/master-requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/watchlist/master-requests", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/access-and-core-data/

57. POST /api/admin/discord/messages

• Purpose: POST /api/admin/discord/messages handled by adminDiscord.ts; admin discord messages route contract must be verified against source before integration.
• Source: partners-api/src/routes/adminDiscord.ts:49
• Mounted prefix: /api
• Route module: adminDiscord.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/discord/messages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/discord/messages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

58. GET /api/admin/discord/targets

• Purpose: GET /api/admin/discord/targets handled by adminDiscord.ts; admin discord targets route contract must be verified against source before integration.
• Source: partners-api/src/routes/adminDiscord.ts:11
• Mounted prefix: /api
• Route module: adminDiscord.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/discord/targets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/discord/targets", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

59. DELETE /api/admin/events/:eventId/registrations

• Purpose: DELETE /api/admin/events/:eventId/registrations handled by admin.ts; admin events eventId registrations route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:927
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/events/:eventId/registrations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/events/:eventId/registrations", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

60. GET /api/admin/members

• Purpose: GET /api/admin/members handled by admin.ts; admin members route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:182
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/members" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

61. POST /api/admin/members

• Purpose: POST /api/admin/members handled by admin.ts; admin members route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:213
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/members" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

62. DELETE /api/admin/members/:membershipId

• Purpose: DELETE /api/admin/members/:membershipId handled by admin.ts; admin members membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:320
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/admin/members/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members/:membershipId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

63. PATCH /api/admin/members/:membershipId

• Purpose: PATCH /api/admin/members/:membershipId handled by admin.ts; admin members membershipId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:382
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: membershipId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/members/:membershipId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/members/:membershipId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

64. GET /api/admin/notices

• Purpose: GET /api/admin/notices handled by notices.ts; admin notices route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:218
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/notices" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

65. POST /api/admin/notices

• Purpose: POST /api/admin/notices handled by notices.ts; admin notices route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:236
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/notices" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

66. PATCH /api/admin/notices/:id

• Purpose: PATCH /api/admin/notices/:id handled by notices.ts; admin notices id route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:350
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/notices/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/notices/:id", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

67. GET /api/admin/partners

• Purpose: GET /api/admin/partners handled by admin.ts; admin partners route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:62
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/partners" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

68. POST /api/admin/partners

• Purpose: POST /api/admin/partners handled by admin.ts; admin partners route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:77
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/partners" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

69. PATCH /api/admin/partners/:partnerId

• Purpose: PATCH /api/admin/partners/:partnerId handled by admin.ts; admin partners partnerId route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:120
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/partners/:partnerId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners/:partnerId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

70. POST /api/admin/partners/:partnerId/cms-token

• Purpose: POST /api/admin/partners/:partnerId/cms-token handled by admin.ts; admin partners partnerId cms token route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:464
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/admin/partners/:partnerId/cms-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/partners/:partnerId/cms-token", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

71. GET /api/admin/platform-fee

• Purpose: GET /api/admin/platform-fee handled by admin.ts; admin platform fee route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:575
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-fee" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-fee", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

72. PATCH /api/admin/platform-fee

• Purpose: PATCH /api/admin/platform-fee handled by admin.ts; admin platform fee route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:592
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/platform-fee" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-fee", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

73. GET /api/admin/platform-security

• Purpose: GET /api/admin/platform-security handled by admin.ts; admin platform security route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:883
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/platform-security" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-security", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

74. PATCH /api/admin/platform-security

• Purpose: PATCH /api/admin/platform-security handled by admin.ts; admin platform security route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:893
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/platform-security" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/platform-security", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

75. PUT /api/admin/settlement-payment-providers

• Purpose: PUT /api/admin/settlement-payment-providers handled by admin.ts; admin settlement payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:749
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/admin/settlement-payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

76. GET /api/admin/settlement-settings

• Purpose: GET /api/admin/settlement-settings handled by admin.ts; admin settlement settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:627
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/admin/settlement-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

77. PATCH /api/admin/settlement-settings

• Purpose: PATCH /api/admin/settlement-settings handled by admin.ts; admin settlement settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/admin.ts:665
• Mounted prefix: /api
• Route module: admin.ts
• Router variable: api
• Stability: admin-only
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/admin/settlement-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/admin/settlement-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

78. GET /api/network-bans/:watchlistEntryId

• Purpose: GET /api/network-bans/:watchlistEntryId handled by networkBans.ts; network bans watchlistEntryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:218
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

79. PATCH /api/network-bans/:watchlistEntryId/appeal

• Purpose: PATCH /api/network-bans/:watchlistEntryId/appeal handled by networkBans.ts; network bans watchlistEntryId appeal route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:522
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

80. POST /api/network-bans/:watchlistEntryId/appeal

• Purpose: POST /api/network-bans/:watchlistEntryId/appeal handled by networkBans.ts; network bans watchlistEntryId appeal route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:277
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

81. GET /api/network-bans/:watchlistEntryId/appeal-status

• Purpose: GET /api/network-bans/:watchlistEntryId/appeal-status handled by networkBans.ts; network bans watchlistEntryId appeal status route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:357
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeal-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeal-status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

82. GET /api/network-bans/:watchlistEntryId/appeals

• Purpose: GET /api/network-bans/:watchlistEntryId/appeals handled by networkBans.ts; network bans watchlistEntryId appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:417
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: watchlistEntryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/:watchlistEntryId/appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/:watchlistEntryId/appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

83. GET /api/network-bans/appeals

• Purpose: GET /api/network-bans/appeals handled by networkBans.ts; network bans appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:14
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

84. POST /api/network-bans/appeals/:appealId/decision

• Purpose: POST /api/network-bans/appeals/:appealId/decision handled by networkBans.ts; network bans appeals appealId decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:94
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appealId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/network-bans/appeals/:appealId/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/appeals/:appealId/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

85. GET /api/network-bans/my-appeals

• Purpose: GET /api/network-bans/my-appeals handled by networkBans.ts; network bans my appeals route contract must be verified against source before integration.
• Source: partners-api/src/routes/networkBans.ts:154
• Mounted prefix: /api
• Route module: networkBans.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/network-bans/my-appeals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/network-bans/my-appeals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

86. POST /api/notices/:id/ack

• Purpose: POST /api/notices/:id/ack handled by notices.ts; notices id ack route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:192
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/notices/:id/ack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/notices/:id/ack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

87. GET /api/notices/unacked

• Purpose: GET /api/notices/unacked handled by notices.ts; notices unacked route contract must be verified against source before integration.
• Source: partners-api/src/routes/notices.ts:133
• Mounted prefix: /api
• Route module: notices.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/notices/unacked" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/notices/unacked", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

88. GET /api/org/settings

• Purpose: GET /api/org/settings handled by orgSettings.ts; org settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:86
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

89. PATCH /api/org/settings

• Purpose: PATCH /api/org/settings handled by orgSettings.ts; org settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:113
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/org/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

90. POST /api/org/settings/data-silo/backfill

• Purpose: POST /api/org/settings/data-silo/backfill handled by orgSettings.ts; org settings data silo backfill route contract must be verified against source before integration.
• Source: partners-api/src/routes/orgSettings.ts:207
• Mounted prefix: /api
• Route module: orgSettings.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/settings/data-silo/backfill" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/settings/data-silo/backfill", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/admin-and-organization/

91. GET /api/access

• Purpose: GET /api/access handled by access.ts; access route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:31
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

92. GET /api/cms-token

• Purpose: GET /api/cms-token handled by access.ts; cms token route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:280
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/cms-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/cms-token", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

93. GET /api/partner-directory

• Purpose: GET /api/partner-directory handled by access.ts; partner directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:257
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

94. GET /api/partner-permissions

• Purpose: GET /api/partner-permissions handled by access.ts; partner permissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:177
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partner-permissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-permissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

95. PUT /api/partner-permissions/members/:userId

• Purpose: PUT /api/partner-permissions/members/:userId handled by access.ts; partner permissions members userId route contract must be verified against source before integration.
• Source: partners-api/src/routes/access.ts:194
• Mounted prefix: /api
• Route module: access.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: userId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partner-permissions/members/:userId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partner-permissions/members/:userId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

96. POST /auth/accept-invite

• Purpose: POST /auth/accept-invite handled by auth.ts; auth accept invite route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:797
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/accept-invite" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/accept-invite", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

97. POST /auth/change-password

• Purpose: POST /auth/change-password handled by auth.ts; auth change password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:730
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/change-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/change-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

98. POST /auth/dev-session

• Purpose: POST /auth/dev-session handled by auth.ts; auth dev session route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:592
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/dev-session" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/dev-session", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

99. POST /auth/exchange

• Purpose: POST /auth/exchange handled by auth.ts; auth exchange route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:698
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/exchange" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/exchange", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

100. GET /auth/mfa/status

• Purpose: GET /auth/mfa/status handled by auth.ts; auth mfa status route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:434
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/auth/mfa/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

101. POST /auth/mfa/totp/enroll

• Purpose: POST /auth/mfa/totp/enroll handled by auth.ts; auth mfa totp enroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:480
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/enroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/enroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

102. POST /auth/mfa/totp/unenroll

• Purpose: POST /auth/mfa/totp/unenroll handled by auth.ts; auth mfa totp unenroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:554
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/unenroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/unenroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

103. POST /auth/mfa/totp/verify

• Purpose: POST /auth/mfa/totp/verify handled by auth.ts; auth mfa totp verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:511
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/mfa/totp/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/mfa/totp/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

104. POST /auth/otp/send

• Purpose: POST /auth/otp/send handled by auth.ts; auth otp send route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:252
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/otp/send" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/otp/send", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

105. POST /auth/otp/verify

• Purpose: POST /auth/otp/verify handled by auth.ts; auth otp verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:293
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/otp/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/otp/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

106. POST /auth/passkey/authentication/options

• Purpose: POST /auth/passkey/authentication/options handled by auth.ts; auth passkey authentication options route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:335
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/authentication/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/authentication/options", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

107. POST /auth/passkey/authentication/verify

• Purpose: POST /auth/passkey/authentication/verify handled by auth.ts; auth passkey authentication verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:354
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/authentication/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/authentication/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

108. POST /auth/passkey/registration/options

• Purpose: POST /auth/passkey/registration/options handled by auth.ts; auth passkey registration options route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:383
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/registration/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/registration/options", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

109. POST /auth/passkey/registration/verify

• Purpose: POST /auth/passkey/registration/verify handled by auth.ts; auth passkey registration verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:404
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/passkey/registration/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/passkey/registration/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

110. POST /auth/refresh

• Purpose: POST /auth/refresh handled by auth.ts; auth refresh route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:651
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/refresh" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/refresh", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

111. POST /auth/reset-password

• Purpose: POST /auth/reset-password handled by auth.ts; auth reset password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:900
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/reset-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/reset-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

112. POST /auth/set-password

• Purpose: POST /auth/set-password handled by auth.ts; auth set password route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:926
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/set-password" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/set-password", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

113. POST /auth/sign-in

• Purpose: POST /auth/sign-in handled by auth.ts; auth sign in route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:224
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-in" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-in", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

114. POST /auth/sign-out

• Purpose: POST /auth/sign-out handled by auth.ts; auth sign out route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:766
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-out" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-out", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

115. POST /auth/sign-up

• Purpose: POST /auth/sign-up handled by auth.ts; auth sign up route contract must be verified against source before integration.
• Source: partners-api/src/routes/auth.ts:872
• Mounted prefix: /auth
• Route module: auth.ts
• Router variable: auth
• Stability: auth-or-webhook
• Authentication: Dashboard auth flow or auth helper route; inspect handler for exact cookie and Supabase behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/auth/sign-up" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/auth/sign-up", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

116. POST /hooks/send-email

• Purpose: POST /hooks/send-email handled by authEmail.ts; hooks send email route contract must be verified against source before integration.
• Source: partners-api/src/routes/authEmail.ts:868
• Mounted prefix: /hooks
• Route module: authEmail.ts
• Router variable: hooks
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May create, refresh, or clear auth/session state. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/send-email" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/send-email", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/auth/

117. GET /api/lan-system/releases/assets/:assetId

• Purpose: GET /api/lan-system/releases/assets/:assetId handled by lanSystemReleases.ts; lan system releases assets assetId route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSystemReleases.ts:154
• Mounted prefix: /api
• Route module: lanSystemReleases.ts
• Router variable: api
• Stability: LAN support
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: assetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/lan-system/releases/assets/:assetId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/lan-system/releases/assets/:assetId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/ems-lan-support/

118. GET /api/lan-system/releases/latest

• Purpose: GET /api/lan-system/releases/latest handled by lanSystemReleases.ts; lan system releases latest route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSystemReleases.ts:99
• Mounted prefix: /api
• Route module: lanSystemReleases.ts
• Router variable: api
• Stability: LAN support
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/lan-system/releases/latest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/lan-system/releases/latest", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/ems-lan-support/

119. GET /api/events/:id/activities

• Purpose: GET /api/events/:id/activities handled by activities.ts; events id activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:610
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

120. PUT /api/events/:id/activities

• Purpose: PUT /api/events/:id/activities handled by activities.ts; events id activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:623
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

121. POST /api/events/:id/activities/submissions/:submissionId/review

• Purpose: POST /api/events/:id/activities/submissions/:submissionId/review handled by activities.ts; events id activities submissions submissionId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:697
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/activities/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

122. PUT /api/events/:id/addons

• Purpose: PUT /api/events/:id/addons handled by eventConfig.ts; events id addons route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:572
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/addons" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/addons", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

123. PUT /api/events/:id/check-in/:kind/:recordId

• Purpose: PUT /api/events/:id/check-in/:kind/:recordId handled by checkIn.ts; events id check in kind recordId route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2533
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

124. PUT /api/events/:id/check-in/:kind/:recordId/claim

• Purpose: PUT /api/events/:id/check-in/:kind/:recordId/claim handled by checkIn.ts; events id check in kind recordId claim route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2616
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId/claim", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

125. GET /api/events/:id/check-in/entries

• Purpose: GET /api/events/:id/check-in/entries handled by checkIn.ts; events id check in entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2227
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

126. GET /api/events/:id/check-in/entry

• Purpose: GET /api/events/:id/check-in/entry handled by checkIn.ts; events id check in entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2239
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

127. GET /api/events/:id/check-in/offline-snapshot

• Purpose: GET /api/events/:id/check-in/offline-snapshot handled by checkIn.ts; events id check in offline snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2375
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

128. GET /api/events/:id/check-in/offline-snapshot/history

• Purpose: GET /api/events/:id/check-in/offline-snapshot/history handled by checkIn.ts; events id check in offline snapshot history route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2362
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

129. POST /api/events/:id/check-in/offline-snapshot/import

• Purpose: POST /api/events/:id/check-in/offline-snapshot/import handled by checkIn.ts; events id check in offline snapshot import route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2496
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/import" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/import", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

130. POST /api/events/:id/check-in/pawsport-lookup

• Purpose: POST /api/events/:id/check-in/pawsport-lookup handled by checkIn.ts; events id check in pawsport lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2262
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/pawsport-lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/pawsport-lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

131. GET /api/events/:id/check-in/settings

• Purpose: GET /api/events/:id/check-in/settings handled by checkIn.ts; events id check in settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2189
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

132. PUT /api/events/:id/check-in/settings

• Purpose: PUT /api/events/:id/check-in/settings handled by checkIn.ts; events id check in settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/checkIn.ts:2202
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

133. GET /api/events/:id/conditions-of-entry

• Purpose: GET /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

134. GET /api/events/:id/conditions-of-entry

• Purpose: GET /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

135. PUT /api/events/:id/conditions-of-entry

• Purpose: PUT /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

136. PUT /api/events/:id/conditions-of-entry

• Purpose: PUT /api/events/:id/conditions-of-entry handled by conditionsOfEntry.ts; events id conditions of entry route contract must be verified against source before integration.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

137. GET /api/events/:id/dealers-den/applications

• Purpose: GET /api/events/:id/dealers-den/applications handled by dealersDen.ts; events id dealers den applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1148
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

138. DELETE /api/events/:id/dealers-den/applications/:appId

• Purpose: DELETE /api/events/:id/dealers-den/applications/:appId handled by dealersDen.ts; events id dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1130
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

139. GET /api/events/:id/dealers-den/applications/:appId

• Purpose: GET /api/events/:id/dealers-den/applications/:appId handled by dealersDen.ts; events id dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1179
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

140. POST /api/events/:id/dealers-den/applications/:appId/approve

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/approve handled by dealersDen.ts; events id dealers den applications appId approve route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1208
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

141. POST /api/events/:id/dealers-den/applications/:appId/deny

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/deny handled by dealersDen.ts; events id dealers den applications appId deny route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1301
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/deny" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/deny", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

142. POST /api/events/:id/dealers-den/applications/:appId/request-changes

• Purpose: POST /api/events/:id/dealers-den/applications/:appId/request-changes handled by dealersDen.ts; events id dealers den applications appId request changes route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1394
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/request-changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/request-changes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

143. GET /api/events/:id/dealers-den/packages

• Purpose: GET /api/events/:id/dealers-den/packages handled by dealersDen.ts; events id dealers den packages route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:739
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

144. POST /api/events/:id/dealers-den/packages

• Purpose: POST /api/events/:id/dealers-den/packages handled by dealersDen.ts; events id dealers den packages route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:755
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

145. DELETE /api/events/:id/dealers-den/packages/:pkgId

• Purpose: DELETE /api/events/:id/dealers-den/packages/:pkgId handled by dealersDen.ts; events id dealers den packages pkgId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:818
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

146. PUT /api/events/:id/dealers-den/packages/:pkgId

• Purpose: PUT /api/events/:id/dealers-den/packages/:pkgId handled by dealersDen.ts; events id dealers den packages pkgId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:797
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

147. PUT /api/events/:id/dealers-den/packages/order

• Purpose: PUT /api/events/:id/dealers-den/packages/order handled by dealersDen.ts; events id dealers den packages order route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:774
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

148. GET /api/events/:id/dealers-den/regos

• Purpose: GET /api/events/:id/dealers-den/regos handled by dealersDen.ts; events id dealers den regos route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:834
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

149. DELETE /api/events/:id/dealers-den/regos/:regoId

• Purpose: DELETE /api/events/:id/dealers-den/regos/:regoId handled by dealersDen.ts; events id dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:905
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

150. PATCH /api/events/:id/dealers-den/regos/:regoId

• Purpose: PATCH /api/events/:id/dealers-den/regos/:regoId handled by dealersDen.ts; events id dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:951
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

151. GET /api/events/:id/dealers-den/settings

• Purpose: GET /api/events/:id/dealers-den/settings handled by dealersDen.ts; events id dealers den settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:639
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

152. PUT /api/events/:id/dealers-den/settings

• Purpose: PUT /api/events/:id/dealers-den/settings handled by dealersDen.ts; events id dealers den settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:682
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

153. GET /api/events/:id/google-wallet-config

• Purpose: GET /api/events/:id/google-wallet-config handled by eventConfig.ts; events id google wallet config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:196
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

154. PUT /api/events/:id/google-wallet-config

• Purpose: PUT /api/events/:id/google-wallet-config handled by eventConfig.ts; events id google wallet config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:257
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

155. GET /api/events/:id/human-resources

• Purpose: GET /api/events/:id/human-resources handled by humanResources.ts; events id human resources route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1328
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

156. PUT /api/events/:id/human-resources

• Purpose: PUT /api/events/:id/human-resources handled by humanResources.ts; events id human resources route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1359
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

157. POST /api/events/:id/human-resources/applications/:applicationId/review

• Purpose: POST /api/events/:id/human-resources/applications/:applicationId/review handled by humanResources.ts; events id human resources applications applicationId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1660
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, applicationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/human-resources/applications/:applicationId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/applications/:applicationId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

158. GET /api/events/:id/human-resources/live-tracker

• Purpose: GET /api/events/:id/human-resources/live-tracker handled by humanResources.ts; events id human resources live tracker route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1619
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/live-tracker" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/live-tracker", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

159. GET /api/events/:id/human-resources/users/search

• Purpose: GET /api/events/:id/human-resources/users/search handled by humanResources.ts; events id human resources users search route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1343
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

160. PUT /api/events/:id/inclusions

• Purpose: PUT /api/events/:id/inclusions handled by eventConfig.ts; events id inclusions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:346
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inclusions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inclusions", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

161. GET /api/events/:id/inventory

• Purpose: GET /api/events/:id/inventory handled by inventory.ts; events id inventory route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1372
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

162. GET /api/events/:id/inventory/movements

• Purpose: GET /api/events/:id/inventory/movements handled by inventory.ts; events id inventory movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1503
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

163. PUT /api/events/:id/inventory/on-hand

• Purpose: PUT /api/events/:id/inventory/on-hand handled by inventory.ts; events id inventory on hand route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1419
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/on-hand" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/on-hand", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

164. POST /api/events/:id/inventory/pos/quote

• Purpose: POST /api/events/:id/inventory/pos/quote handled by inventory.ts; events id inventory pos quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1567
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

165. GET /api/events/:id/inventory/pos/transactions

• Purpose: GET /api/events/:id/inventory/pos/transactions handled by inventory.ts; events id inventory pos transactions route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1547
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

166. POST /api/events/:id/inventory/pos/transactions

• Purpose: POST /api/events/:id/inventory/pos/transactions handled by inventory.ts; events id inventory pos transactions route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1622
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

167. PUT /api/events/:id/inventory/settings

• Purpose: PUT /api/events/:id/inventory/settings handled by inventory.ts; events id inventory settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1386
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

168. POST /api/events/:id/notifications/sample

• Purpose: POST /api/events/:id/notifications/sample handled by eventConfig.ts; events id notifications sample route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:54
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/notifications/sample" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/notifications/sample", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

169. GET /api/events/:id/prefills

• Purpose: GET /api/events/:id/prefills handled by eventConfig.ts; events id prefills route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:77
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

170. POST /api/events/:id/prefills/:prefillId/revoke

• Purpose: POST /api/events/:id/prefills/:prefillId/revoke handled by eventConfig.ts; events id prefills prefillId revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:115
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, prefillId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/prefills/:prefillId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills/:prefillId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

171. GET /api/events/:id/rego/analytics

• Purpose: GET /api/events/:id/rego/analytics handled by regoAnalytics.ts; events id rego analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAnalytics.ts:159
• Mounted prefix: /api
• Route module: regoAnalytics.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

172. PUT /api/events/:id/tiers

• Purpose: PUT /api/events/:id/tiers handled by eventConfig.ts; events id tiers route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventConfig.ts:427
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/tiers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/tiers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

173. GET /api/manage/:id/activities

• Purpose: GET /api/manage/:id/activities is the Event Management compatibility alias for /api/events/:id/activities.
• Source: partners-api/src/routes/activities.ts:610
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

174. PUT /api/manage/:id/activities

• Purpose: PUT /api/manage/:id/activities is the Event Management compatibility alias for /api/events/:id/activities.
• Source: partners-api/src/routes/activities.ts:623
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

175. POST /api/manage/:id/activities/submissions/:submissionId/review

• Purpose: POST /api/manage/:id/activities/submissions/:submissionId/review is the Event Management compatibility alias for /api/events/:id/activities/submissions/:submissionId/review.
• Source: partners-api/src/routes/activities.ts:697
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/activities/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/activities/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

176. PUT /api/manage/:id/addons

• Purpose: PUT /api/manage/:id/addons is the Event Management compatibility alias for /api/events/:id/addons.
• Source: partners-api/src/routes/eventConfig.ts:572
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/addons" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/addons", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

177. PUT /api/manage/:id/check-in/:kind/:recordId

• Purpose: PUT /api/manage/:id/check-in/:kind/:recordId is the Event Management compatibility alias for /api/events/:id/check-in/:kind/:recordId.
• Source: partners-api/src/routes/checkIn.ts:2533
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

178. PUT /api/manage/:id/check-in/:kind/:recordId/claim

• Purpose: PUT /api/manage/:id/check-in/:kind/:recordId/claim is the Event Management compatibility alias for /api/events/:id/check-in/:kind/:recordId/claim.
• Source: partners-api/src/routes/checkIn.ts:2616
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, kind, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/:kind/:recordId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/:kind/:recordId/claim", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

179. GET /api/manage/:id/check-in/entries

• Purpose: GET /api/manage/:id/check-in/entries is the Event Management compatibility alias for /api/events/:id/check-in/entries.
• Source: partners-api/src/routes/checkIn.ts:2227
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

180. GET /api/manage/:id/check-in/entry

• Purpose: GET /api/manage/:id/check-in/entry is the Event Management compatibility alias for /api/events/:id/check-in/entry.
• Source: partners-api/src/routes/checkIn.ts:2239
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

181. GET /api/manage/:id/check-in/offline-snapshot

• Purpose: GET /api/manage/:id/check-in/offline-snapshot is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot.
• Source: partners-api/src/routes/checkIn.ts:2375
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

182. GET /api/manage/:id/check-in/offline-snapshot/history

• Purpose: GET /api/manage/:id/check-in/offline-snapshot/history is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot/history.
• Source: partners-api/src/routes/checkIn.ts:2362
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

183. POST /api/manage/:id/check-in/offline-snapshot/import

• Purpose: POST /api/manage/:id/check-in/offline-snapshot/import is the Event Management compatibility alias for /api/events/:id/check-in/offline-snapshot/import.
• Source: partners-api/src/routes/checkIn.ts:2496
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/offline-snapshot/import" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/offline-snapshot/import", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

184. POST /api/manage/:id/check-in/pawsport-lookup

• Purpose: POST /api/manage/:id/check-in/pawsport-lookup is the Event Management compatibility alias for /api/events/:id/check-in/pawsport-lookup.
• Source: partners-api/src/routes/checkIn.ts:2262
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/check-in/pawsport-lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/pawsport-lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

185. GET /api/manage/:id/check-in/settings

• Purpose: GET /api/manage/:id/check-in/settings is the Event Management compatibility alias for /api/events/:id/check-in/settings.
• Source: partners-api/src/routes/checkIn.ts:2189
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

186. PUT /api/manage/:id/check-in/settings

• Purpose: PUT /api/manage/:id/check-in/settings is the Event Management compatibility alias for /api/events/:id/check-in/settings.
• Source: partners-api/src/routes/checkIn.ts:2202
• Mounted prefix: /api
• Route module: checkIn.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/check-in/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/check-in/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

187. GET /api/manage/:id/conditions-of-entry

• Purpose: GET /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

188. GET /api/manage/:id/conditions-of-entry

• Purpose: GET /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:37
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

189. PUT /api/manage/:id/conditions-of-entry

• Purpose: PUT /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

190. PUT /api/manage/:id/conditions-of-entry

• Purpose: PUT /api/manage/:id/conditions-of-entry is the Event Management compatibility alias for /api/events/:id/conditions-of-entry.
• Source: partners-api/src/routes/conditionsOfEntry.ts:77
• Mounted prefix: /api
• Route module: conditionsOfEntry.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/conditions-of-entry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/conditions-of-entry", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

191. GET /api/manage/:id/dealers-den/applications

• Purpose: GET /api/manage/:id/dealers-den/applications is the Event Management compatibility alias for /api/events/:id/dealers-den/applications.
• Source: partners-api/src/routes/dealersDen.ts:1148
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

192. DELETE /api/manage/:id/dealers-den/applications/:appId

• Purpose: DELETE /api/manage/:id/dealers-den/applications/:appId is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId.
• Source: partners-api/src/routes/dealersDen.ts:1130
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

193. GET /api/manage/:id/dealers-den/applications/:appId

• Purpose: GET /api/manage/:id/dealers-den/applications/:appId is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId.
• Source: partners-api/src/routes/dealersDen.ts:1179
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

194. POST /api/manage/:id/dealers-den/applications/:appId/approve

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/approve is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/approve.
• Source: partners-api/src/routes/dealersDen.ts:1208
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/approve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/approve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

195. POST /api/manage/:id/dealers-den/applications/:appId/deny

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/deny is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/deny.
• Source: partners-api/src/routes/dealersDen.ts:1301
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/deny" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/deny", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

196. POST /api/manage/:id/dealers-den/applications/:appId/request-changes

• Purpose: POST /api/manage/:id/dealers-den/applications/:appId/request-changes is the Event Management compatibility alias for /api/events/:id/dealers-den/applications/:appId/request-changes.
• Source: partners-api/src/routes/dealersDen.ts:1394
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/applications/:appId/request-changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/applications/:appId/request-changes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

197. GET /api/manage/:id/dealers-den/packages

• Purpose: GET /api/manage/:id/dealers-den/packages is the Event Management compatibility alias for /api/events/:id/dealers-den/packages.
• Source: partners-api/src/routes/dealersDen.ts:739
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

198. POST /api/manage/:id/dealers-den/packages

• Purpose: POST /api/manage/:id/dealers-den/packages is the Event Management compatibility alias for /api/events/:id/dealers-den/packages.
• Source: partners-api/src/routes/dealersDen.ts:755
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/dealers-den/packages" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

199. DELETE /api/manage/:id/dealers-den/packages/:pkgId

• Purpose: DELETE /api/manage/:id/dealers-den/packages/:pkgId is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/:pkgId.
• Source: partners-api/src/routes/dealersDen.ts:818
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

200. PUT /api/manage/:id/dealers-den/packages/:pkgId

• Purpose: PUT /api/manage/:id/dealers-den/packages/:pkgId is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/:pkgId.
• Source: partners-api/src/routes/dealersDen.ts:797
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, pkgId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/:pkgId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/:pkgId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

201. PUT /api/manage/:id/dealers-den/packages/order

• Purpose: PUT /api/manage/:id/dealers-den/packages/order is the Event Management compatibility alias for /api/events/:id/dealers-den/packages/order.
• Source: partners-api/src/routes/dealersDen.ts:774
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/packages/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/packages/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

202. GET /api/manage/:id/dealers-den/regos

• Purpose: GET /api/manage/:id/dealers-den/regos is the Event Management compatibility alias for /api/events/:id/dealers-den/regos.
• Source: partners-api/src/routes/dealersDen.ts:834
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

203. DELETE /api/manage/:id/dealers-den/regos/:regoId

• Purpose: DELETE /api/manage/:id/dealers-den/regos/:regoId is the Event Management compatibility alias for /api/events/:id/dealers-den/regos/:regoId.
• Source: partners-api/src/routes/dealersDen.ts:905
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

204. PATCH /api/manage/:id/dealers-den/regos/:regoId

• Purpose: PATCH /api/manage/:id/dealers-den/regos/:regoId is the Event Management compatibility alias for /api/events/:id/dealers-den/regos/:regoId.
• Source: partners-api/src/routes/dealersDen.ts:951
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/regos/:regoId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

205. GET /api/manage/:id/dealers-den/settings

• Purpose: GET /api/manage/:id/dealers-den/settings is the Event Management compatibility alias for /api/events/:id/dealers-den/settings.
• Source: partners-api/src/routes/dealersDen.ts:639
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

206. PUT /api/manage/:id/dealers-den/settings

• Purpose: PUT /api/manage/:id/dealers-den/settings is the Event Management compatibility alias for /api/events/:id/dealers-den/settings.
• Source: partners-api/src/routes/dealersDen.ts:682
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/dealers-den/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/dealers-den/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

207. GET /api/manage/:id/google-wallet-config

• Purpose: GET /api/manage/:id/google-wallet-config is the Event Management compatibility alias for /api/events/:id/google-wallet-config.
• Source: partners-api/src/routes/eventConfig.ts:196
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

208. PUT /api/manage/:id/google-wallet-config

• Purpose: PUT /api/manage/:id/google-wallet-config is the Event Management compatibility alias for /api/events/:id/google-wallet-config.
• Source: partners-api/src/routes/eventConfig.ts:257
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/google-wallet-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/google-wallet-config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

209. GET /api/manage/:id/human-resources

• Purpose: GET /api/manage/:id/human-resources is the Event Management compatibility alias for /api/events/:id/human-resources.
• Source: partners-api/src/routes/humanResources.ts:1328
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

210. PUT /api/manage/:id/human-resources

• Purpose: PUT /api/manage/:id/human-resources is the Event Management compatibility alias for /api/events/:id/human-resources.
• Source: partners-api/src/routes/humanResources.ts:1359
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/human-resources" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

211. POST /api/manage/:id/human-resources/applications/:applicationId/review

• Purpose: POST /api/manage/:id/human-resources/applications/:applicationId/review is the Event Management compatibility alias for /api/events/:id/human-resources/applications/:applicationId/review.
• Source: partners-api/src/routes/humanResources.ts:1660
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, applicationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/human-resources/applications/:applicationId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/applications/:applicationId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

212. GET /api/manage/:id/human-resources/live-tracker

• Purpose: GET /api/manage/:id/human-resources/live-tracker is the Event Management compatibility alias for /api/events/:id/human-resources/live-tracker.
• Source: partners-api/src/routes/humanResources.ts:1619
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/live-tracker" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/live-tracker", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

213. GET /api/manage/:id/human-resources/users/search

• Purpose: GET /api/manage/:id/human-resources/users/search is the Event Management compatibility alias for /api/events/:id/human-resources/users/search.
• Source: partners-api/src/routes/humanResources.ts:1343
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/human-resources/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/human-resources/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

214. PUT /api/manage/:id/inclusions

• Purpose: PUT /api/manage/:id/inclusions is the Event Management compatibility alias for /api/events/:id/inclusions.
• Source: partners-api/src/routes/eventConfig.ts:346
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inclusions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inclusions", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

215. GET /api/manage/:id/inventory

• Purpose: GET /api/manage/:id/inventory is the Event Management compatibility alias for /api/events/:id/inventory.
• Source: partners-api/src/routes/inventory.ts:1372
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

216. GET /api/manage/:id/inventory/movements

• Purpose: GET /api/manage/:id/inventory/movements is the Event Management compatibility alias for /api/events/:id/inventory/movements.
• Source: partners-api/src/routes/inventory.ts:1503
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

217. PUT /api/manage/:id/inventory/on-hand

• Purpose: PUT /api/manage/:id/inventory/on-hand is the Event Management compatibility alias for /api/events/:id/inventory/on-hand.
• Source: partners-api/src/routes/inventory.ts:1419
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/on-hand" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/on-hand", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

218. POST /api/manage/:id/inventory/pos/quote

• Purpose: POST /api/manage/:id/inventory/pos/quote is the Event Management compatibility alias for /api/events/:id/inventory/pos/quote.
• Source: partners-api/src/routes/inventory.ts:1567
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

219. GET /api/manage/:id/inventory/pos/transactions

• Purpose: GET /api/manage/:id/inventory/pos/transactions is the Event Management compatibility alias for /api/events/:id/inventory/pos/transactions.
• Source: partners-api/src/routes/inventory.ts:1547
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

220. POST /api/manage/:id/inventory/pos/transactions

• Purpose: POST /api/manage/:id/inventory/pos/transactions is the Event Management compatibility alias for /api/events/:id/inventory/pos/transactions.
• Source: partners-api/src/routes/inventory.ts:1622
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/inventory/pos/transactions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/pos/transactions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

221. PUT /api/manage/:id/inventory/settings

• Purpose: PUT /api/manage/:id/inventory/settings is the Event Management compatibility alias for /api/events/:id/inventory/settings.
• Source: partners-api/src/routes/inventory.ts:1386
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/inventory/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/inventory/settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

222. POST /api/manage/:id/notifications/sample

• Purpose: POST /api/manage/:id/notifications/sample is the Event Management compatibility alias for /api/events/:id/notifications/sample.
• Source: partners-api/src/routes/eventConfig.ts:54
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/notifications/sample" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/notifications/sample", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

223. GET /api/manage/:id/prefills

• Purpose: GET /api/manage/:id/prefills is the Event Management compatibility alias for /api/events/:id/prefills.
• Source: partners-api/src/routes/eventConfig.ts:77
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

224. POST /api/manage/:id/prefills/:prefillId/revoke

• Purpose: POST /api/manage/:id/prefills/:prefillId/revoke is the Event Management compatibility alias for /api/events/:id/prefills/:prefillId/revoke.
• Source: partners-api/src/routes/eventConfig.ts:115
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, prefillId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/prefills/:prefillId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/prefills/:prefillId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

225. GET /api/manage/:id/rego/analytics

• Purpose: GET /api/manage/:id/rego/analytics is the Event Management compatibility alias for /api/events/:id/rego/analytics.
• Source: partners-api/src/routes/regoAnalytics.ts:159
• Mounted prefix: /api
• Route module: regoAnalytics.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

226. PUT /api/manage/:id/tiers

• Purpose: PUT /api/manage/:id/tiers is the Event Management compatibility alias for /api/events/:id/tiers.
• Source: partners-api/src/routes/eventConfig.ts:427
• Mounted prefix: /api
• Route module: eventConfig.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/tiers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/tiers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

227. GET /api/rego/activities/submissions/my

• Purpose: GET /api/rego/activities/submissions/my handled by activities.ts; rego activities submissions my route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:929
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/activities/submissions/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/activities/submissions/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

228. GET /api/rego/dealers-den/:eventId/info

• Purpose: GET /api/rego/dealers-den/:eventId/info handled by dealersDen.ts; rego dealers den eventId info route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1492
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/:eventId/info" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/:eventId/info", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

229. POST /api/rego/dealers-den/applications

• Purpose: POST /api/rego/dealers-den/applications handled by dealersDen.ts; rego dealers den applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1735
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

230. DELETE /api/rego/dealers-den/applications/:appId

• Purpose: DELETE /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1947
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

231. GET /api/rego/dealers-den/applications/:appId

• Purpose: GET /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1685
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

232. PATCH /api/rego/dealers-den/applications/:appId

• Purpose: PATCH /api/rego/dealers-den/applications/:appId handled by dealersDen.ts; rego dealers den applications appId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1869
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/dealers-den/applications/:appId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

233. POST /api/rego/dealers-den/applications/:appId/assistants

• Purpose: POST /api/rego/dealers-den/applications/:appId/assistants handled by dealersDen.ts; rego dealers den applications appId assistants route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1985
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/applications/:appId/assistants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId/assistants", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

234. DELETE /api/rego/dealers-den/applications/:appId/assistants/:aid

• Purpose: DELETE /api/rego/dealers-den/applications/:appId/assistants/:aid handled by dealersDen.ts; rego dealers den applications appId assistants aid route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2066
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: appId, aid
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/dealers-den/applications/:appId/assistants/:aid" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/:appId/assistants/:aid", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

235. GET /api/rego/dealers-den/applications/my

• Purpose: GET /api/rego/dealers-den/applications/my handled by dealersDen.ts; rego dealers den applications my route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1597
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/applications/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/applications/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

236. PATCH /api/rego/dealers-den/assistants/:aid/respond

• Purpose: PATCH /api/rego/dealers-den/assistants/:aid/respond handled by dealersDen.ts; rego dealers den assistants aid respond route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2103
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: aid
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/dealers-den/assistants/:aid/respond" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/assistants/:aid/respond", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

237. POST /api/rego/dealers-den/events/:eventId/reserve

• Purpose: POST /api/rego/dealers-den/events/:eventId/reserve handled by dealersDen.ts; rego dealers den events eventId reserve route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2142
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/events/:eventId/reserve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/events/:eventId/reserve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

238. GET /api/rego/dealers-den/regos/:regoId

• Purpose: GET /api/rego/dealers-den/regos/:regoId handled by dealersDen.ts; rego dealers den regos regoId route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2648
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/:regoId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/:regoId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

239. GET /api/rego/dealers-den/regos/:regoId/wallet

• Purpose: GET /api/rego/dealers-den/regos/:regoId/wallet handled by dealersDen.ts; rego dealers den regos regoId wallet route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2778
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: regoId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/:regoId/wallet" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/:regoId/wallet", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

240. GET /api/rego/dealers-den/regos/my

• Purpose: GET /api/rego/dealers-den/regos/my handled by dealersDen.ts; rego dealers den regos my route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:1617
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/dealers-den/regos/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

241. POST /api/rego/dealers-den/regos/submit

• Purpose: POST /api/rego/dealers-den/regos/submit handled by dealersDen.ts; rego dealers den regos submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2264
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/regos/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/regos/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

242. POST /api/rego/dealers-den/reservations/:id/release

• Purpose: POST /api/rego/dealers-den/reservations/:id/release handled by dealersDen.ts; rego dealers den reservations id release route contract must be verified against source before integration.
• Source: partners-api/src/routes/dealersDen.ts:2242
• Mounted prefix: /api
• Route module: dealersDen.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/dealers-den/reservations/:id/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/dealers-den/reservations/:id/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

243. GET /api/rego/events/:slug/activities

• Purpose: GET /api/rego/events/:slug/activities handled by activities.ts; rego events slug activities route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:788
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

244. GET /api/rego/events/:slug/activities/:activitySlug

• Purpose: GET /api/rego/events/:slug/activities/:activitySlug handled by activities.ts; rego events slug activities activitySlug route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:1032
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, activitySlug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities/:activitySlug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/:activitySlug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

245. POST /api/rego/events/:slug/activities/:activitySlug/submissions

• Purpose: POST /api/rego/events/:slug/activities/:activitySlug/submissions handled by activities.ts; rego events slug activities activitySlug submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:1087
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug, activitySlug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/activities/:activitySlug/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/:activitySlug/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

246. GET /api/rego/events/:slug/activities/submissions/my

• Purpose: GET /api/rego/events/:slug/activities/submissions/my handled by activities.ts; rego events slug activities submissions my route contract must be verified against source before integration.
• Source: partners-api/src/routes/activities.ts:841
• Mounted prefix: /api
• Route module: activities.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/activities/submissions/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/activities/submissions/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

247. GET /api/rego/events/:slug/shift-authorizers

• Purpose: GET /api/rego/events/:slug/shift-authorizers handled by humanResources.ts; rego events slug shift authorizers route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:2165
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/shift-authorizers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/shift-authorizers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

248. POST /api/rego/events/:slug/volunteer-applications

• Purpose: POST /api/rego/events/:slug/volunteer-applications handled by humanResources.ts; rego events slug volunteer applications route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1844
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/volunteer-applications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/volunteer-applications", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

249. GET /api/rego/events/:slug/volunteer-opportunities

• Purpose: GET /api/rego/events/:slug/volunteer-opportunities handled by humanResources.ts; rego events slug volunteer opportunities route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1748
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/volunteer-opportunities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/volunteer-opportunities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

250. GET /api/rego/human-resources/me

• Purpose: GET /api/rego/human-resources/me handled by humanResources.ts; rego human resources me route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:1982
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/human-resources/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/human-resources/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

251. POST /api/rego/human-resources/shifts/:shiftId/track

• Purpose: POST /api/rego/human-resources/shifts/:shiftId/track handled by humanResources.ts; rego human resources shifts shiftId track route contract must be verified against source before integration.
• Source: partners-api/src/routes/humanResources.ts:2202
• Mounted prefix: /api
• Route module: humanResources.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: shiftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/human-resources/shifts/:shiftId/track" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/human-resources/shifts/:shiftId/track", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

252. POST /api/rego/notices/:id/ack

• Purpose: POST /api/rego/notices/:id/ack handled by regoNotices.ts; rego notices id ack route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:146
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notices/:id/ack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notices/:id/ack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

253. GET /api/rego/notices/unacked

• Purpose: GET /api/rego/notices/unacked handled by regoNotices.ts; rego notices unacked route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:60
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notices/unacked" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notices/unacked", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

254. GET /api/rego/notifications

• Purpose: GET /api/rego/notifications handled by regoNotices.ts; rego notifications route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:193
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notifications" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

255. POST /api/rego/notifications/:id/read

• Purpose: POST /api/rego/notifications/:id/read handled by regoNotices.ts; rego notifications id read route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:280
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notifications/:id/read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/:id/read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

256. POST /api/rego/notifications/mark-all-read

• Purpose: POST /api/rego/notifications/mark-all-read handled by regoNotices.ts; rego notifications mark all read route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:308
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/notifications/mark-all-read" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/mark-all-read", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

257. GET /api/rego/notifications/unread-count

• Purpose: GET /api/rego/notifications/unread-count handled by regoNotices.ts; rego notifications unread count route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoNotices.ts:256
• Mounted prefix: /api
• Route module: regoNotices.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/notifications/unread-count" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/notifications/unread-count", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

258. GET /api/rego/transactions/me

• Purpose: GET /api/rego/transactions/me handled by inventory.ts; rego transactions me route contract must be verified against source before integration.
• Source: partners-api/src/routes/inventory.ts:1730
• Mounted prefix: /api
• Route module: inventory.ts
• Router variable: regoApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/transactions/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/transactions/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/event-management/

259. POST /api/events/:eventId/payment-accounts/:accountId/report

• Purpose: POST /api/events/:eventId/payment-accounts/:accountId/report handled by paymentAccountReports.ts; events eventId payment accounts accountId report route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccountReports.ts:18
• Mounted prefix: /api
• Route module: paymentAccountReports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/payment-accounts/:accountId/report" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/payment-accounts/:accountId/report", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

260. GET /api/events/:id/finance-programs

• Purpose: GET /api/events/:id/finance-programs handled by financePrograms.ts; events id finance programs route contract must be verified against source before integration.
• Source: partners-api/src/routes/financePrograms.ts:478
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

261. PUT /api/events/:id/finance-programs

• Purpose: PUT /api/events/:id/finance-programs handled by financePrograms.ts; events id finance programs route contract must be verified against source before integration.
• Source: partners-api/src/routes/financePrograms.ts:493
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

262. GET /api/events/:id/finance/accounting

• Purpose: GET /api/events/:id/finance/accounting handled by finance.ts; events id finance accounting route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1022
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/accounting" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

263. POST /api/events/:id/finance/accounting/deductions

• Purpose: POST /api/events/:id/finance/accounting/deductions handled by finance.ts; events id finance accounting deductions route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1190
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/deductions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/deductions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

264. POST /api/events/:id/finance/accounting/entries

• Purpose: POST /api/events/:id/finance/accounting/entries handled by finance.ts; events id finance accounting entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1177
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

265. PATCH /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId

• Purpose: PATCH /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId handled by finance.ts; events id finance accounting ledger sourceType sourceId route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1203
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, sourceType, sourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

266. GET /api/events/:id/finance/analytics

• Purpose: GET /api/events/:id/finance/analytics handled by finance.ts; events id finance analytics route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:998
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

267. GET /api/events/:id/finance/settlements

• Purpose: GET /api/events/:id/finance/settlements handled by finance.ts; events id finance settlements route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1293
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

268. POST /api/events/:id/finance/settlements

• Purpose: POST /api/events/:id/finance/settlements handled by finance.ts; events id finance settlements route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1356
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

269. POST /api/events/:id/finance/settlements/quote

• Purpose: POST /api/events/:id/finance/settlements/quote handled by finance.ts; events id finance settlements quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/finance.ts:1319
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

270. GET /api/events/:id/payment-account-reports

• Purpose: GET /api/events/:id/payment-account-reports handled by paymentAccounts.ts; events id payment account reports route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:202
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-account-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-account-reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

271. GET /api/events/:id/payment-accounts

• Purpose: GET /api/events/:id/payment-accounts handled by paymentAccounts.ts; events id payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:93
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

272. PUT /api/events/:id/payment-accounts

• Purpose: PUT /api/events/:id/payment-accounts handled by paymentAccounts.ts; events id payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentAccounts.ts:117
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

273. GET /api/events/:id/payment-providers

• Purpose: GET /api/events/:id/payment-providers handled by paymentProviders.ts; events id payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentProviders.ts:125
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

274. PUT /api/events/:id/payment-providers

• Purpose: PUT /api/events/:id/payment-providers handled by paymentProviders.ts; events id payment providers route contract must be verified against source before integration.
• Source: partners-api/src/routes/paymentProviders.ts:182
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

275. GET /api/events/:id/rego-refunds

• Purpose: GET /api/events/:id/rego-refunds handled by regoRefunds.ts; events id rego refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:959
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

276. PATCH /api/events/:id/rego-refunds/:refundId/review

• Purpose: PATCH /api/events/:id/rego-refunds/:refundId/review handled by regoRefunds.ts; events id rego refunds refundId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:981
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, refundId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-refunds/:refundId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds/:refundId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

277. GET /api/events/:id/rego-transfers

• Purpose: GET /api/events/:id/rego-transfers handled by regoTransfers.ts; events id rego transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:928
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

278. PATCH /api/events/:id/rego-transfers/:transferId/review

• Purpose: PATCH /api/events/:id/rego-transfers/:transferId/review handled by regoTransfers.ts; events id rego transfers transferId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:950
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, transferId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-transfers/:transferId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers/:transferId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

279. GET /api/events/:id/rego-upgrades

• Purpose: GET /api/events/:id/rego-upgrades handled by regoUpgrades.ts; events id rego upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1332
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

280. PATCH /api/events/:id/rego-upgrades/:upgradeId/review

• Purpose: PATCH /api/events/:id/rego-upgrades/:upgradeId/review handled by regoUpgrades.ts; events id rego upgrades upgradeId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1396
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, upgradeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-upgrades/:upgradeId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades/:upgradeId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

281. POST /api/manage/:eventId/payment-accounts/:accountId/report

• Purpose: POST /api/manage/:eventId/payment-accounts/:accountId/report is the Event Management compatibility alias for /api/events/:eventId/payment-accounts/:accountId/report.
• Source: partners-api/src/routes/paymentAccountReports.ts:18
• Mounted prefix: /api
• Route module: paymentAccountReports.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, accountId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/payment-accounts/:accountId/report" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/payment-accounts/:accountId/report", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

282. GET /api/manage/:id/finance-programs

• Purpose: GET /api/manage/:id/finance-programs is the Event Management compatibility alias for /api/events/:id/finance-programs.
• Source: partners-api/src/routes/financePrograms.ts:478
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

283. PUT /api/manage/:id/finance-programs

• Purpose: PUT /api/manage/:id/finance-programs is the Event Management compatibility alias for /api/events/:id/finance-programs.
• Source: partners-api/src/routes/financePrograms.ts:493
• Mounted prefix: /api
• Route module: financePrograms.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/finance-programs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance-programs", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

284. GET /api/manage/:id/finance/accounting

• Purpose: GET /api/manage/:id/finance/accounting is the Event Management compatibility alias for /api/events/:id/finance/accounting.
• Source: partners-api/src/routes/finance.ts:1022
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/accounting" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

285. POST /api/manage/:id/finance/accounting/deductions

• Purpose: POST /api/manage/:id/finance/accounting/deductions is the Event Management compatibility alias for /api/events/:id/finance/accounting/deductions.
• Source: partners-api/src/routes/finance.ts:1190
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/deductions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/deductions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

286. POST /api/manage/:id/finance/accounting/entries

• Purpose: POST /api/manage/:id/finance/accounting/entries is the Event Management compatibility alias for /api/events/:id/finance/accounting/entries.
• Source: partners-api/src/routes/finance.ts:1177
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/accounting/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

287. PATCH /api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId

• Purpose: PATCH /api/manage/:id/finance/accounting/ledger/:sourceType/:sourceId is the Event Management compatibility alias for /api/events/:id/finance/accounting/ledger/:sourceType/:sourceId.
• Source: partners-api/src/routes/finance.ts:1203
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, sourceType, sourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/accounting/ledger/:sourceType/:sourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

288. GET /api/manage/:id/finance/analytics

• Purpose: GET /api/manage/:id/finance/analytics is the Event Management compatibility alias for /api/events/:id/finance/analytics.
• Source: partners-api/src/routes/finance.ts:998
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/analytics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/analytics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

289. GET /api/manage/:id/finance/settlements

• Purpose: GET /api/manage/:id/finance/settlements is the Event Management compatibility alias for /api/events/:id/finance/settlements.
• Source: partners-api/src/routes/finance.ts:1293
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

290. POST /api/manage/:id/finance/settlements

• Purpose: POST /api/manage/:id/finance/settlements is the Event Management compatibility alias for /api/events/:id/finance/settlements.
• Source: partners-api/src/routes/finance.ts:1356
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

291. POST /api/manage/:id/finance/settlements/quote

• Purpose: POST /api/manage/:id/finance/settlements/quote is the Event Management compatibility alias for /api/events/:id/finance/settlements/quote.
• Source: partners-api/src/routes/finance.ts:1319
• Mounted prefix: /api
• Route module: finance.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/finance/settlements/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/finance/settlements/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

292. GET /api/manage/:id/payment-account-reports

• Purpose: GET /api/manage/:id/payment-account-reports is the Event Management compatibility alias for /api/events/:id/payment-account-reports.
• Source: partners-api/src/routes/paymentAccounts.ts:202
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-account-reports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-account-reports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

293. GET /api/manage/:id/payment-accounts

• Purpose: GET /api/manage/:id/payment-accounts is the Event Management compatibility alias for /api/events/:id/payment-accounts.
• Source: partners-api/src/routes/paymentAccounts.ts:93
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

294. PUT /api/manage/:id/payment-accounts

• Purpose: PUT /api/manage/:id/payment-accounts is the Event Management compatibility alias for /api/events/:id/payment-accounts.
• Source: partners-api/src/routes/paymentAccounts.ts:117
• Mounted prefix: /api
• Route module: paymentAccounts.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

295. GET /api/manage/:id/payment-providers

• Purpose: GET /api/manage/:id/payment-providers is the Event Management compatibility alias for /api/events/:id/payment-providers.
• Source: partners-api/src/routes/paymentProviders.ts:125
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

296. PUT /api/manage/:id/payment-providers

• Purpose: PUT /api/manage/:id/payment-providers is the Event Management compatibility alias for /api/events/:id/payment-providers.
• Source: partners-api/src/routes/paymentProviders.ts:182
• Mounted prefix: /api
• Route module: paymentProviders.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/payment-providers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/payment-providers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

297. GET /api/manage/:id/rego-refunds

• Purpose: GET /api/manage/:id/rego-refunds is the Event Management compatibility alias for /api/events/:id/rego-refunds.
• Source: partners-api/src/routes/regoRefunds.ts:959
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

298. PATCH /api/manage/:id/rego-refunds/:refundId/review

• Purpose: PATCH /api/manage/:id/rego-refunds/:refundId/review is the Event Management compatibility alias for /api/events/:id/rego-refunds/:refundId/review.
• Source: partners-api/src/routes/regoRefunds.ts:981
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, refundId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-refunds/:refundId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-refunds/:refundId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

299. GET /api/manage/:id/rego-transfers

• Purpose: GET /api/manage/:id/rego-transfers is the Event Management compatibility alias for /api/events/:id/rego-transfers.
• Source: partners-api/src/routes/regoTransfers.ts:928
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

300. PATCH /api/manage/:id/rego-transfers/:transferId/review

• Purpose: PATCH /api/manage/:id/rego-transfers/:transferId/review is the Event Management compatibility alias for /api/events/:id/rego-transfers/:transferId/review.
• Source: partners-api/src/routes/regoTransfers.ts:950
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, transferId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-transfers/:transferId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-transfers/:transferId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

301. GET /api/manage/:id/rego-upgrades

• Purpose: GET /api/manage/:id/rego-upgrades is the Event Management compatibility alias for /api/events/:id/rego-upgrades.
• Source: partners-api/src/routes/regoUpgrades.ts:1332
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

302. PATCH /api/manage/:id/rego-upgrades/:upgradeId/review

• Purpose: PATCH /api/manage/:id/rego-upgrades/:upgradeId/review is the Event Management compatibility alias for /api/events/:id/rego-upgrades/:upgradeId/review.
• Source: partners-api/src/routes/regoUpgrades.ts:1396
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: partnerApi
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, upgradeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/rego-upgrades/:upgradeId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-upgrades/:upgradeId/review", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

303. POST /api/rego/rego-upgrades/:id/pay

• Purpose: POST /api/rego/rego-upgrades/:id/pay handled by regoUpgrades.ts; rego rego upgrades id pay route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1199
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/rego-upgrades/:id/pay" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/rego-upgrades/:id/pay", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

304. GET /api/rego/regos/:ref/refunds

• Purpose: GET /api/rego/regos/:ref/refunds handled by regoRefunds.ts; rego regos ref refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:744
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/refunds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

305. POST /api/rego/regos/:ref/refunds

• Purpose: POST /api/rego/regos/:ref/refunds handled by regoRefunds.ts; rego regos ref refunds route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoRefunds.ts:799
• Mounted prefix: /api
• Route module: regoRefunds.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/refunds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/refunds", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

306. GET /api/rego/regos/:ref/transfers

• Purpose: GET /api/rego/regos/:ref/transfers handled by regoTransfers.ts; rego regos ref transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:630
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/transfers", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

307. POST /api/rego/regos/:ref/transfers

• Purpose: POST /api/rego/regos/:ref/transfers handled by regoTransfers.ts; rego regos ref transfers route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:692
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/transfers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/transfers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

308. GET /api/rego/regos/:ref/upgrades

• Purpose: GET /api/rego/regos/:ref/upgrades handled by regoUpgrades.ts; rego regos ref upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:945
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/upgrades", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

309. POST /api/rego/regos/:ref/upgrades

• Purpose: POST /api/rego/regos/:ref/upgrades handled by regoUpgrades.ts; rego regos ref upgrades route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoUpgrades.ts:1034
• Mounted prefix: /api
• Route module: regoUpgrades.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos/:ref/upgrades" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/upgrades", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

310. GET /api/rego/users/transfer-search

• Purpose: GET /api/rego/users/transfer-search handled by regoTransfers.ts; rego users transfer search route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoTransfers.ts:599
• Mounted prefix: /api
• Route module: regoTransfers.ts
• Router variable: regoApi
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/users/transfer-search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/users/transfer-search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/finance-and-payments/

311. POST /api/assets

• Purpose: POST /api/assets handled by assets.ts; assets route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:863
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

312. GET /api/assets/agreements

• Purpose: GET /api/assets/agreements handled by assets.ts; assets agreements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:804
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/agreements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/agreements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

313. POST /api/assets/agreements

• Purpose: POST /api/assets/agreements handled by assets.ts; assets agreements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:819
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/agreements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/agreements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

314. GET /api/assets/alerts

• Purpose: GET /api/assets/alerts handled by assets.ts; assets alerts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2085
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/alerts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/alerts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

315. GET /api/assets/audits

• Purpose: GET /api/assets/audits handled by assets.ts; assets audits route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:576
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/audits" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

316. POST /api/assets/audits/:id/count-sheet/validate

• Purpose: POST /api/assets/audits/:id/count-sheet/validate handled by assets.ts; assets audits id count sheet validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2051
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/audits/:id/count-sheet/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits/:id/count-sheet/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

317. GET /api/assets/audits/:id/results

• Purpose: GET /api/assets/audits/:id/results handled by assets.ts; assets audits id results route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:594
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/audits/:id/results" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/audits/:id/results", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

318. GET /api/assets/capabilities

• Purpose: GET /api/assets/capabilities handled by assets.ts; assets capabilities route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2397
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/capabilities" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/capabilities", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

319. PUT /api/assets/capabilities/:key

• Purpose: PUT /api/assets/capabilities/:key handled by assets.ts; assets capabilities key route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2411
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: key
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/capabilities/:key" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/capabilities/:key", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

320. GET /api/assets/catalog

• Purpose: GET /api/assets/catalog handled by assets.ts; assets catalog route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:712
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/catalog" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

321. POST /api/assets/catalog/categories

• Purpose: POST /api/assets/catalog/categories handled by assets.ts; assets catalog categories route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:737
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/catalog/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

322. POST /api/assets/catalog/models

• Purpose: POST /api/assets/catalog/models handled by assets.ts; assets catalog models route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:754
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/catalog/models" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/catalog/models", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

323. GET /api/assets/checkouts

• Purpose: GET /api/assets/checkouts handled by assets.ts; assets checkouts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:999
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/checkouts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

324. POST /api/assets/checkouts

• Purpose: POST /api/assets/checkouts handled by assets.ts; assets checkouts route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:982
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

325. POST /api/assets/checkouts/:id/acknowledge

• Purpose: POST /api/assets/checkouts/:id/acknowledge handled by assets.ts; assets checkouts id acknowledge route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1033
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts/:id/acknowledge" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/acknowledge", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

326. GET /api/assets/checkouts/:id/eligibility

• Purpose: GET /api/assets/checkouts/:id/eligibility handled by assets.ts; assets checkouts id eligibility route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1045
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/checkouts/:id/eligibility" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/eligibility", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

327. POST /api/assets/checkouts/:id/return

• Purpose: POST /api/assets/checkouts/:id/return handled by assets.ts; assets checkouts id return route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1071
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/checkouts/:id/return" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/checkouts/:id/return", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

328. POST /api/assets/containers/:id/pack

• Purpose: POST /api/assets/containers/:id/pack handled by assets.ts; assets containers id pack route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1150
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/containers/:id/pack" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/containers/:id/pack", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

329. DELETE /api/assets/drafts/:workflowKey

• Purpose: DELETE /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1912
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

330. GET /api/assets/drafts/:workflowKey

• Purpose: GET /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1893
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

331. PUT /api/assets/drafts/:workflowKey

• Purpose: PUT /api/assets/drafts/:workflowKey handled by assets.ts; assets drafts workflowKey route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1902
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: workflowKey
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/drafts/:workflowKey" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/drafts/:workflowKey", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

332. GET /api/assets/eligible-users

• Purpose: GET /api/assets/eligible-users handled by assets.ts; assets eligible users route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:517
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/eligible-users" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/eligible-users", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

333. GET /api/assets/evidence

• Purpose: GET /api/assets/evidence handled by assets.ts; assets evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2280
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

334. POST /api/assets/evidence

• Purpose: POST /api/assets/evidence handled by assets.ts; assets evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2198
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

335. GET /api/assets/evidence/:id/content

• Purpose: GET /api/assets/evidence/:id/content handled by assets.ts; assets evidence id content route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2302
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/evidence/:id/content" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence/:id/content", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

336. POST /api/assets/evidence/:id/review

• Purpose: POST /api/assets/evidence/:id/review handled by assets.ts; assets evidence id review route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2350
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/evidence/:id/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/evidence/:id/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

337. GET /api/assets/finance/adapters/:format

• Purpose: GET /api/assets/finance/adapters/:format handled by assets.ts; assets finance adapters format route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2383
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: format
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/adapters/:format" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/adapters/:format", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

338. GET /api/assets/finance/context

• Purpose: GET /api/assets/finance/context handled by assets.ts; assets finance context route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1219
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/context" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/context", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

339. GET /api/assets/finance/rollforward

• Purpose: GET /api/assets/finance/rollforward handled by assets.ts; assets finance rollforward route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1199
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/finance/rollforward" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/rollforward", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

340. POST /api/assets/finance/value-entries

• Purpose: POST /api/assets/finance/value-entries handled by assets.ts; assets finance value entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1231
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/finance/value-entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/finance/value-entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

341. GET /api/assets/hub/overview

• Purpose: GET /api/assets/hub/overview handled by assets.ts; assets hub overview route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1314
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/overview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/overview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

342. GET /api/assets/hub/records

• Purpose: GET /api/assets/hub/records handled by assets.ts; assets hub records route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1430
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

343. GET /api/assets/hub/summary

• Purpose: GET /api/assets/hub/summary handled by assets.ts; assets hub summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1331
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

344. GET /api/assets/hub/tasks

• Purpose: GET /api/assets/hub/tasks handled by assets.ts; assets hub tasks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1377
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/hub/tasks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/tasks", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

345. POST /api/assets/hub/tasks/assign

• Purpose: POST /api/assets/hub/tasks/assign handled by assets.ts; assets hub tasks assign route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1694
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/hub/tasks/assign" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/hub/tasks/assign", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

346. POST /api/assets/identifiers/issue

• Purpose: POST /api/assets/identifiers/issue handled by assets.ts; assets identifiers issue route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:906
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/identifiers/issue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/identifiers/issue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

347. GET /api/assets/imports/:id

• Purpose: GET /api/assets/imports/:id handled by assets.ts; assets imports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2070
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/imports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/imports/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

348. POST /api/assets/imports/csv/validate

• Purpose: POST /api/assets/imports/csv/validate handled by assets.ts; assets imports csv validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2030
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/imports/csv/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/imports/csv/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

349. GET /api/assets/interoperability/epcis

• Purpose: GET /api/assets/interoperability/epcis handled by assets.ts; assets interoperability epcis route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2010
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/interoperability/epcis" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/interoperability/epcis", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

350. GET /api/assets/interoperability/snapshot

• Purpose: GET /api/assets/interoperability/snapshot handled by assets.ts; assets interoperability snapshot route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2000
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/interoperability/snapshot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/interoperability/snapshot", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

351. GET /api/assets/items/:id

• Purpose: GET /api/assets/items/:id handled by assets.ts; assets items id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:552
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/items/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/items/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

352. POST /api/assets/items/:id/activate

• Purpose: POST /api/assets/items/:id/activate handled by assets.ts; assets items id activate route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:891
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/items/:id/activate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/items/:id/activate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

353. GET /api/assets/loaned

• Purpose: GET /api/assets/loaned handled by assets.ts; assets loaned route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:475
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/loaned" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/loaned", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

354. GET /api/assets/locations

• Purpose: GET /api/assets/locations handled by assets.ts; assets locations route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:677
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/locations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/locations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

355. POST /api/assets/locations

• Purpose: POST /api/assets/locations handled by assets.ts; assets locations route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:691
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/locations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/locations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

356. GET /api/assets/movements

• Purpose: GET /api/assets/movements handled by assets.ts; assets movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:839
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/movements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

357. GET /api/assets/openapi.json

• Purpose: GET /api/assets/openapi.json handled by assets.ts; assets openapi.json route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:375
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/openapi.json" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/openapi.json", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

358. GET /api/assets/owned

• Purpose: GET /api/assets/owned handled by assets.ts; assets owned route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:474
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/owned" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/owned", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

359. GET /api/assets/parties

• Purpose: GET /api/assets/parties handled by assets.ts; assets parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:771
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/parties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

360. POST /api/assets/parties

• Purpose: POST /api/assets/parties handled by assets.ts; assets parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:785
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/parties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

361. GET /api/assets/policies

• Purpose: GET /api/assets/policies handled by assets.ts; assets policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1979
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

362. POST /api/assets/policies

• Purpose: POST /api/assets/policies handled by assets.ts; assets policies route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1921
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

363. GET /api/assets/policies/:id

• Purpose: GET /api/assets/policies/:id handled by assets.ts; assets policies id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1971
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/policies/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

364. POST /api/assets/policies/:id/decision

• Purpose: POST /api/assets/policies/:id/decision handled by assets.ts; assets policies id decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1961
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies/:id/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

365. POST /api/assets/policies/:id/submit

• Purpose: POST /api/assets/policies/:id/submit handled by assets.ts; assets policies id submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1951
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/policies/:id/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/policies/:id/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

366. GET /api/assets/saved-views

• Purpose: GET /api/assets/saved-views handled by assets.ts; assets saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:477
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

367. POST /api/assets/saved-views

• Purpose: POST /api/assets/saved-views handled by assets.ts; assets saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:491
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

368. DELETE /api/assets/saved-views/:id

• Purpose: DELETE /api/assets/saved-views/:id handled by assets.ts; assets saved views id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:505
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/assets/saved-views/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/saved-views/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

369. POST /api/assets/scan/resolve

• Purpose: POST /api/assets/scan/resolve handled by assets.ts; assets scan resolve route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:931
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/scan/resolve" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/scan/resolve", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

370. GET /api/assets/search

• Purpose: GET /api/assets/search handled by assets.ts; assets search route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:659
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

371. GET /api/assets/settings/records

• Purpose: GET /api/assets/settings/records handled by assets.ts; assets settings records route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1452
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/settings/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/settings/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

372. GET /api/assets/shipments

• Purpose: GET /api/assets/shipments handled by assets.ts; assets shipments route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1109
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/shipments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

373. POST /api/assets/shipments

• Purpose: POST /api/assets/shipments handled by assets.ts; assets shipments route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1092
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

374. POST /api/assets/shipments/:id/containers

• Purpose: POST /api/assets/shipments/:id/containers handled by assets.ts; assets shipments id containers route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1131
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/containers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/containers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

375. POST /api/assets/shipments/:id/dispatch

• Purpose: POST /api/assets/shipments/:id/dispatch handled by assets.ts; assets shipments id dispatch route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1170
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/dispatch" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/dispatch", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

376. POST /api/assets/shipments/:id/receive

• Purpose: POST /api/assets/shipments/:id/receive handled by assets.ts; assets shipments id receive route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1184
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/shipments/:id/receive" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/shipments/:id/receive", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

377. GET /api/assets/summary

• Purpose: GET /api/assets/summary handled by assets.ts; assets summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:380
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

378. GET /api/assets/transit-exceptions

• Purpose: GET /api/assets/transit-exceptions handled by assets.ts; assets transit exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:625
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/transit-exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/transit-exceptions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

379. GET /api/assets/webhooks

• Purpose: GET /api/assets/webhooks handled by assets.ts; assets webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2122
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

380. POST /api/assets/webhooks

• Purpose: POST /api/assets/webhooks handled by assets.ts; assets webhooks route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2099
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/webhooks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

381. PUT /api/assets/webhooks/:id

• Purpose: PUT /api/assets/webhooks/:id handled by assets.ts; assets webhooks id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2133
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/assets/webhooks/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

382. GET /api/assets/webhooks/:id/deliveries

• Purpose: GET /api/assets/webhooks/:id/deliveries handled by assets.ts; assets webhooks id deliveries route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2186
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/webhooks/:id/deliveries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id/deliveries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

383. POST /api/assets/webhooks/:id/test

• Purpose: POST /api/assets/webhooks/:id/test handled by assets.ts; assets webhooks id test route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:2166
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/webhooks/:id/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/webhooks/:id/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

384. GET /api/assets/work-orders

• Purpose: GET /api/assets/work-orders handled by assets.ts; assets work orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:609
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/work-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/work-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

385. GET /api/assets/work-orders/:id

• Purpose: GET /api/assets/work-orders/:id handled by assets.ts; assets work orders id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:632
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/work-orders/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/work-orders/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

386. GET /api/assets/workflow-cases

• Purpose: GET /api/assets/workflow-cases handled by assets.ts; assets workflow cases route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1754
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/workflow-cases" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

387. POST /api/assets/workflow-cases

• Purpose: POST /api/assets/workflow-cases handled by assets.ts; assets workflow cases route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1861
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/workflow-cases" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

388. GET /api/assets/workflow-cases/:id

• Purpose: GET /api/assets/workflow-cases/:id handled by assets.ts; assets workflow cases id route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1796
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/assets/workflow-cases/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

389. POST /api/assets/workflow-cases/:id/decision

• Purpose: POST /api/assets/workflow-cases/:id/decision handled by assets.ts; assets workflow cases id decision route contract must be verified against source before integration.
• Source: partners-api/src/routes/assets.ts:1826
• Mounted prefix: /api
• Route module: assets.ts
• Router variable: assetsRoutes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/assets/workflow-cases/:id/decision" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/assets/workflow-cases/:id/decision", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

390. GET /api/attendee-accounts/lookup

• Purpose: GET /api/attendee-accounts/lookup handled by attendeeAccounts.ts; attendee accounts lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/attendeeAccounts.ts:39
• Mounted prefix: /api
• Route module: attendeeAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/attendee-accounts/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/attendee-accounts/lookup", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

391. GET /api/attendee-accounts/search

• Purpose: GET /api/attendee-accounts/search handled by attendeeAccounts.ts; attendee accounts search route contract must be verified against source before integration.
• Source: partners-api/src/routes/attendeeAccounts.ts:25
• Mounted prefix: /api
• Route module: attendeeAccounts.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/attendee-accounts/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/attendee-accounts/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

392. GET /api/events/:eventId/feedback-form

• Purpose: GET /api/events/:eventId/feedback-form handled by eventFeedback.ts; events eventId feedback form route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:128
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-form" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

393. PUT /api/events/:eventId/feedback-form/draft

• Purpose: PUT /api/events/:eventId/feedback-form/draft handled by eventFeedback.ts; events eventId feedback form draft route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:142
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:eventId/feedback-form/draft" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/draft", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

394. POST /api/events/:eventId/feedback-form/publish

• Purpose: POST /api/events/:eventId/feedback-form/publish handled by eventFeedback.ts; events eventId feedback form publish route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:202
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

395. POST /api/events/:eventId/feedback-form/standard-template

• Purpose: POST /api/events/:eventId/feedback-form/standard-template handled by eventFeedback.ts; events eventId feedback form standard template route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:176
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/standard-template" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/standard-template", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

396. GET /api/events/:eventId/feedback-submissions

• Purpose: GET /api/events/:eventId/feedback-submissions handled by eventFeedback.ts; events eventId feedback submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:540
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

397. GET /api/events/:eventId/feedback-submissions/:submissionId

• Purpose: GET /api/events/:eventId/feedback-submissions/:submissionId handled by eventFeedback.ts; events eventId feedback submissions submissionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:459
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

398. PATCH /api/events/:eventId/feedback-submissions/:submissionId

• Purpose: PATCH /api/events/:eventId/feedback-submissions/:submissionId handled by eventFeedback.ts; events eventId feedback submissions submissionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:485
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

399. POST /api/events/:eventId/feedback-submissions/:submissionId/notes

• Purpose: POST /api/events/:eventId/feedback-submissions/:submissionId/notes handled by eventFeedback.ts; events eventId feedback submissions submissionId notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:510
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

400. GET /api/events/:eventId/feedback-submissions/export.csv

• Purpose: GET /api/events/:eventId/feedback-submissions/export.csv handled by eventFeedback.ts; events eventId feedback submissions export.csv route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:406
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

401. GET /api/events/:eventId/forecasts

• Purpose: GET /api/events/:eventId/forecasts handled by forecasting.ts; events eventId forecasts route contract must be verified against source before integration.
• Source: partners-api/src/routes/forecasting.ts:47
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/forecasts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

402. PATCH /api/events/:eventId/forecasts/control

• Purpose: PATCH /api/events/:eventId/forecasts/control handled by forecasting.ts; events eventId forecasts control route contract must be verified against source before integration.
• Source: partners-api/src/routes/forecasting.ts:78
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/forecasts/control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts/control", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

403. GET /api/events/:eventId/lan-sync/changes

• Purpose: GET /api/events/:eventId/lan-sync/changes handled by lanSync.ts; events eventId lan sync changes route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:384
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/changes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

404. POST /api/events/:eventId/lan-sync/evidence

• Purpose: POST /api/events/:eventId/lan-sync/evidence handled by lanSync.ts; events eventId lan sync evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:285
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

405. GET /api/events/:eventId/lan-sync/health

• Purpose: GET /api/events/:eventId/lan-sync/health handled by lanSync.ts; events eventId lan sync health route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:230
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

406. POST /api/events/:eventId/lan-sync/operations

• Purpose: POST /api/events/:eventId/lan-sync/operations handled by lanSync.ts; events eventId lan sync operations route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:245
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/operations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/operations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

407. GET /api/events/:eventId/lan-sync/sessions

• Purpose: GET /api/events/:eventId/lan-sync/sessions handled by lanSync.ts; events eventId lan sync sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:162
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

408. POST /api/events/:eventId/lan-sync/sessions

• Purpose: POST /api/events/:eventId/lan-sync/sessions handled by lanSync.ts; events eventId lan sync sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:176
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

409. POST /api/events/:eventId/lan-sync/sessions/:sessionId/revoke

• Purpose: POST /api/events/:eventId/lan-sync/sessions/:sessionId/revoke handled by lanSync.ts; events eventId lan sync sessions sessionId revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/lanSync.ts:213
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions/:sessionId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions/:sessionId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

410. GET /api/events/:id/shop/cart

• Purpose: GET /api/events/:id/shop/cart handled by eventShop.ts; events id shop cart route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1514
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/cart" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

411. POST /api/events/:id/shop/cart/items

• Purpose: POST /api/events/:id/shop/cart/items handled by eventShop.ts; events id shop cart items route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1525
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

412. DELETE /api/events/:id/shop/cart/items/:listingId

• Purpose: DELETE /api/events/:id/shop/cart/items/:listingId handled by eventShop.ts; events id shop cart items listingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1565
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/cart/items/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

413. POST /api/events/:id/shop/cart/validate

• Purpose: POST /api/events/:id/shop/cart/validate handled by eventShop.ts; events id shop cart validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1584
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

414. POST /api/events/:id/shop/categories

• Purpose: POST /api/events/:id/shop/categories handled by eventShop.ts; events id shop categories route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1424
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

415. DELETE /api/events/:id/shop/categories/:categoryId

• Purpose: DELETE /api/events/:id/shop/categories/:categoryId handled by eventShop.ts; events id shop categories categoryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1456
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, categoryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/categories/:categoryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/:categoryId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

416. PUT /api/events/:id/shop/categories/order

• Purpose: PUT /api/events/:id/shop/categories/order handled by eventShop.ts; events id shop categories order route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1443
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/categories/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

417. POST /api/events/:id/shop/checkout

• Purpose: POST /api/events/:id/shop/checkout handled by eventShop.ts; events id shop checkout route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1595
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/checkout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/checkout", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

418. POST /api/events/:id/shop/claim/lookup

• Purpose: POST /api/events/:id/shop/claim/lookup handled by eventShop.ts; events id shop claim lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2397
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/claim/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/claim/lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

419. GET /api/events/:id/shop/config

• Purpose: GET /api/events/:id/shop/config handled by eventShop.ts; events id shop config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1283
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

420. POST /api/events/:id/shop/config

• Purpose: POST /api/events/:id/shop/config handled by eventShop.ts; events id shop config route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1294
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

421. POST /api/events/:id/shop/couriers

• Purpose: POST /api/events/:id/shop/couriers handled by eventShop.ts; events id shop couriers route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1478
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

422. POST /api/events/:id/shop/couriers/:courierId/rates

• Purpose: POST /api/events/:id/shop/couriers/:courierId/rates handled by eventShop.ts; events id shop couriers courierId rates route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1497
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, courierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers/:courierId/rates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers/:courierId/rates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

423. GET /api/events/:id/shop/listings

• Purpose: GET /api/events/:id/shop/listings handled by eventShop.ts; events id shop listings route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1307
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

424. POST /api/events/:id/shop/listings

• Purpose: POST /api/events/:id/shop/listings handled by eventShop.ts; events id shop listings route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1368
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

425. DELETE /api/events/:id/shop/listings/:listingId

• Purpose: DELETE /api/events/:id/shop/listings/:listingId handled by eventShop.ts; events id shop listings listingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1401
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/listings/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

426. PUT /api/events/:id/shop/listings/order

• Purpose: PUT /api/events/:id/shop/listings/order handled by eventShop.ts; events id shop listings order route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1388
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/listings/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

427. GET /api/events/:id/shop/my-orders

• Purpose: GET /api/events/:id/shop/my-orders handled by eventShop.ts; events id shop my orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1774
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

428. GET /api/events/:id/shop/my-orders/:orderId

• Purpose: GET /api/events/:id/shop/my-orders/:orderId handled by eventShop.ts; events id shop my orders orderId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1789
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

429. POST /api/events/:id/shop/my-orders/:orderId/payment

• Purpose: POST /api/events/:id/shop/my-orders/:orderId/payment handled by eventShop.ts; events id shop my orders orderId payment route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1834
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId/payment" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId/payment", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

430. GET /api/events/:id/shop/orders

• Purpose: GET /api/events/:id/shop/orders handled by eventShop.ts; events id shop orders route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1901
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

431. GET /api/events/:id/shop/orders/:orderId

• Purpose: GET /api/events/:id/shop/orders/:orderId handled by eventShop.ts; events id shop orders orderId route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2035
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

432. POST /api/events/:id/shop/orders/:orderId/claim

• Purpose: POST /api/events/:id/shop/orders/:orderId/claim handled by eventShop.ts; events id shop orders orderId claim route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2229
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

433. POST /api/events/:id/shop/orders/:orderId/claim-exception

• Purpose: POST /api/events/:id/shop/orders/:orderId/claim-exception handled by eventShop.ts; events id shop orders orderId claim exception route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2304
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim-exception" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim-exception", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

434. POST /api/events/:id/shop/orders/:orderId/payment-review

• Purpose: POST /api/events/:id/shop/orders/:orderId/payment-review handled by eventShop.ts; events id shop orders orderId payment review route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2120
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

435. POST /api/events/:id/shop/orders/:orderId/status

• Purpose: POST /api/events/:id/shop/orders/:orderId/status handled by eventShop.ts; events id shop orders orderId status route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2063
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/status", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

436. POST /api/events/:id/shop/orders/:orderId/updates

• Purpose: POST /api/events/:id/shop/orders/:orderId/updates handled by eventShop.ts; events id shop orders orderId updates route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:2183
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/updates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/updates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

437. GET /api/events/:id/shop/orders/dashboard

• Purpose: GET /api/events/:id/shop/orders/dashboard handled by eventShop.ts; events id shop orders dashboard route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1924
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/dashboard" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/dashboard", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

438. GET /api/events/:id/shop/public

• Purpose: GET /api/events/:id/shop/public handled by eventShop.ts; events id shop public route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1271
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/public" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/public", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

439. GET /api/events/:id/shop/source-items

• Purpose: GET /api/events/:id/shop/source-items handled by eventShop.ts; events id shop source items route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventShop.ts:1319
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/source-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/source-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

440. GET /api/geo/countries

• Purpose: GET /api/geo/countries handled by geo.ts; geo countries route contract must be verified against source before integration.
• Source: partners-api/src/routes/geo.ts:55
• Mounted prefix: /api
• Route module: geo.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/geo/countries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/geo/countries", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

441. GET /api/geo/states/:iso2

• Purpose: GET /api/geo/states/:iso2 handled by geo.ts; geo states iso2 route contract must be verified against source before integration.
• Source: partners-api/src/routes/geo.ts:69
• Mounted prefix: /api
• Route module: geo.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: iso2
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/geo/states/:iso2" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/geo/states/:iso2", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

442. GET /api/manage/:eventId/feedback-form

• Purpose: GET /api/manage/:eventId/feedback-form is the Event Management compatibility alias for /api/events/:eventId/feedback-form.
• Source: partners-api/src/routes/eventFeedback.ts:128
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-form" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

443. PUT /api/manage/:eventId/feedback-form/draft

• Purpose: PUT /api/manage/:eventId/feedback-form/draft is the Event Management compatibility alias for /api/events/:eventId/feedback-form/draft.
• Source: partners-api/src/routes/eventFeedback.ts:142
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:eventId/feedback-form/draft" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/draft", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

444. POST /api/manage/:eventId/feedback-form/publish

• Purpose: POST /api/manage/:eventId/feedback-form/publish is the Event Management compatibility alias for /api/events/:eventId/feedback-form/publish.
• Source: partners-api/src/routes/eventFeedback.ts:202
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/publish" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/publish", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

445. POST /api/manage/:eventId/feedback-form/standard-template

• Purpose: POST /api/manage/:eventId/feedback-form/standard-template is the Event Management compatibility alias for /api/events/:eventId/feedback-form/standard-template.
• Source: partners-api/src/routes/eventFeedback.ts:176
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-form/standard-template" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-form/standard-template", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

446. GET /api/manage/:eventId/feedback-submissions

• Purpose: GET /api/manage/:eventId/feedback-submissions is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions.
• Source: partners-api/src/routes/eventFeedback.ts:540
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

447. GET /api/manage/:eventId/feedback-submissions/:submissionId

• Purpose: GET /api/manage/:eventId/feedback-submissions/:submissionId is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId.
• Source: partners-api/src/routes/eventFeedback.ts:459
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

448. PATCH /api/manage/:eventId/feedback-submissions/:submissionId

• Purpose: PATCH /api/manage/:eventId/feedback-submissions/:submissionId is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId.
• Source: partners-api/src/routes/eventFeedback.ts:485
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

449. POST /api/manage/:eventId/feedback-submissions/:submissionId/notes

• Purpose: POST /api/manage/:eventId/feedback-submissions/:submissionId/notes is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/:submissionId/notes.
• Source: partners-api/src/routes/eventFeedback.ts:510
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/feedback-submissions/:submissionId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/:submissionId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

450. GET /api/manage/:eventId/feedback-submissions/export.csv

• Purpose: GET /api/manage/:eventId/feedback-submissions/export.csv is the Event Management compatibility alias for /api/events/:eventId/feedback-submissions/export.csv.
• Source: partners-api/src/routes/eventFeedback.ts:406
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/feedback-submissions/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/feedback-submissions/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

451. GET /api/manage/:eventId/forecasts

• Purpose: GET /api/manage/:eventId/forecasts is the Event Management compatibility alias for /api/events/:eventId/forecasts.
• Source: partners-api/src/routes/forecasting.ts:47
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/forecasts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

452. PATCH /api/manage/:eventId/forecasts/control

• Purpose: PATCH /api/manage/:eventId/forecasts/control is the Event Management compatibility alias for /api/events/:eventId/forecasts/control.
• Source: partners-api/src/routes/forecasting.ts:78
• Mounted prefix: /api
• Route module: forecasting.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:eventId/forecasts/control" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/forecasts/control", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

453. GET /api/manage/:eventId/lan-sync/changes

• Purpose: GET /api/manage/:eventId/lan-sync/changes is the Event Management compatibility alias for /api/events/:eventId/lan-sync/changes.
• Source: partners-api/src/routes/lanSync.ts:384
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/changes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/changes", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

454. POST /api/manage/:eventId/lan-sync/evidence

• Purpose: POST /api/manage/:eventId/lan-sync/evidence is the Event Management compatibility alias for /api/events/:eventId/lan-sync/evidence.
• Source: partners-api/src/routes/lanSync.ts:285
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

455. GET /api/manage/:eventId/lan-sync/health

• Purpose: GET /api/manage/:eventId/lan-sync/health is the Event Management compatibility alias for /api/events/:eventId/lan-sync/health.
• Source: partners-api/src/routes/lanSync.ts:230
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

456. POST /api/manage/:eventId/lan-sync/operations

• Purpose: POST /api/manage/:eventId/lan-sync/operations is the Event Management compatibility alias for /api/events/:eventId/lan-sync/operations.
• Source: partners-api/src/routes/lanSync.ts:245
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/operations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/operations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

457. GET /api/manage/:eventId/lan-sync/sessions

• Purpose: GET /api/manage/:eventId/lan-sync/sessions is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions.
• Source: partners-api/src/routes/lanSync.ts:162
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

458. POST /api/manage/:eventId/lan-sync/sessions

• Purpose: POST /api/manage/:eventId/lan-sync/sessions is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions.
• Source: partners-api/src/routes/lanSync.ts:176
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

459. POST /api/manage/:eventId/lan-sync/sessions/:sessionId/revoke

• Purpose: POST /api/manage/:eventId/lan-sync/sessions/:sessionId/revoke is the Event Management compatibility alias for /api/events/:eventId/lan-sync/sessions/:sessionId/revoke.
• Source: partners-api/src/routes/lanSync.ts:213
• Mounted prefix: /api
• Route module: lanSync.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:eventId/lan-sync/sessions/:sessionId/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:eventId/lan-sync/sessions/:sessionId/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

460. GET /api/manage/:id/shop/cart

• Purpose: GET /api/manage/:id/shop/cart is the Event Management compatibility alias for /api/events/:id/shop/cart.
• Source: partners-api/src/routes/eventShop.ts:1514
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/cart" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

461. POST /api/manage/:id/shop/cart/items

• Purpose: POST /api/manage/:id/shop/cart/items is the Event Management compatibility alias for /api/events/:id/shop/cart/items.
• Source: partners-api/src/routes/eventShop.ts:1525
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

462. DELETE /api/manage/:id/shop/cart/items/:listingId

• Purpose: DELETE /api/manage/:id/shop/cart/items/:listingId is the Event Management compatibility alias for /api/events/:id/shop/cart/items/:listingId.
• Source: partners-api/src/routes/eventShop.ts:1565
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/cart/items/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/items/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

463. POST /api/manage/:id/shop/cart/validate

• Purpose: POST /api/manage/:id/shop/cart/validate is the Event Management compatibility alias for /api/events/:id/shop/cart/validate.
• Source: partners-api/src/routes/eventShop.ts:1584
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/cart/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/cart/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

464. POST /api/manage/:id/shop/categories

• Purpose: POST /api/manage/:id/shop/categories is the Event Management compatibility alias for /api/events/:id/shop/categories.
• Source: partners-api/src/routes/eventShop.ts:1424
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/categories" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

465. DELETE /api/manage/:id/shop/categories/:categoryId

• Purpose: DELETE /api/manage/:id/shop/categories/:categoryId is the Event Management compatibility alias for /api/events/:id/shop/categories/:categoryId.
• Source: partners-api/src/routes/eventShop.ts:1456
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, categoryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/categories/:categoryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/:categoryId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

466. PUT /api/manage/:id/shop/categories/order

• Purpose: PUT /api/manage/:id/shop/categories/order is the Event Management compatibility alias for /api/events/:id/shop/categories/order.
• Source: partners-api/src/routes/eventShop.ts:1443
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/categories/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/categories/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

467. POST /api/manage/:id/shop/checkout

• Purpose: POST /api/manage/:id/shop/checkout is the Event Management compatibility alias for /api/events/:id/shop/checkout.
• Source: partners-api/src/routes/eventShop.ts:1595
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/checkout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/checkout", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

468. POST /api/manage/:id/shop/claim/lookup

• Purpose: POST /api/manage/:id/shop/claim/lookup is the Event Management compatibility alias for /api/events/:id/shop/claim/lookup.
• Source: partners-api/src/routes/eventShop.ts:2397
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/claim/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/claim/lookup", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

469. GET /api/manage/:id/shop/config

• Purpose: GET /api/manage/:id/shop/config is the Event Management compatibility alias for /api/events/:id/shop/config.
• Source: partners-api/src/routes/eventShop.ts:1283
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

470. POST /api/manage/:id/shop/config

• Purpose: POST /api/manage/:id/shop/config is the Event Management compatibility alias for /api/events/:id/shop/config.
• Source: partners-api/src/routes/eventShop.ts:1294
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/config", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

471. POST /api/manage/:id/shop/couriers

• Purpose: POST /api/manage/:id/shop/couriers is the Event Management compatibility alias for /api/events/:id/shop/couriers.
• Source: partners-api/src/routes/eventShop.ts:1478
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

472. POST /api/manage/:id/shop/couriers/:courierId/rates

• Purpose: POST /api/manage/:id/shop/couriers/:courierId/rates is the Event Management compatibility alias for /api/events/:id/shop/couriers/:courierId/rates.
• Source: partners-api/src/routes/eventShop.ts:1497
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, courierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/couriers/:courierId/rates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/couriers/:courierId/rates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

473. GET /api/manage/:id/shop/listings

• Purpose: GET /api/manage/:id/shop/listings is the Event Management compatibility alias for /api/events/:id/shop/listings.
• Source: partners-api/src/routes/eventShop.ts:1307
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

474. POST /api/manage/:id/shop/listings

• Purpose: POST /api/manage/:id/shop/listings is the Event Management compatibility alias for /api/events/:id/shop/listings.
• Source: partners-api/src/routes/eventShop.ts:1368
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/listings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

475. DELETE /api/manage/:id/shop/listings/:listingId

• Purpose: DELETE /api/manage/:id/shop/listings/:listingId is the Event Management compatibility alias for /api/events/:id/shop/listings/:listingId.
• Source: partners-api/src/routes/eventShop.ts:1401
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, listingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/events/:id/shop/listings/:listingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/:listingId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

476. PUT /api/manage/:id/shop/listings/order

• Purpose: PUT /api/manage/:id/shop/listings/order is the Event Management compatibility alias for /api/events/:id/shop/listings/order.
• Source: partners-api/src/routes/eventShop.ts:1388
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/shop/listings/order" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/listings/order", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

477. GET /api/manage/:id/shop/my-orders

• Purpose: GET /api/manage/:id/shop/my-orders is the Event Management compatibility alias for /api/events/:id/shop/my-orders.
• Source: partners-api/src/routes/eventShop.ts:1774
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

478. GET /api/manage/:id/shop/my-orders/:orderId

• Purpose: GET /api/manage/:id/shop/my-orders/:orderId is the Event Management compatibility alias for /api/events/:id/shop/my-orders/:orderId.
• Source: partners-api/src/routes/eventShop.ts:1789
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

479. POST /api/manage/:id/shop/my-orders/:orderId/payment

• Purpose: POST /api/manage/:id/shop/my-orders/:orderId/payment is the Event Management compatibility alias for /api/events/:id/shop/my-orders/:orderId/payment.
• Source: partners-api/src/routes/eventShop.ts:1834
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/my-orders/:orderId/payment" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/my-orders/:orderId/payment", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

480. GET /api/manage/:id/shop/orders

• Purpose: GET /api/manage/:id/shop/orders is the Event Management compatibility alias for /api/events/:id/shop/orders.
• Source: partners-api/src/routes/eventShop.ts:1901
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

481. GET /api/manage/:id/shop/orders/:orderId

• Purpose: GET /api/manage/:id/shop/orders/:orderId is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId.
• Source: partners-api/src/routes/eventShop.ts:2035
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/:orderId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

482. POST /api/manage/:id/shop/orders/:orderId/claim

• Purpose: POST /api/manage/:id/shop/orders/:orderId/claim is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/claim.
• Source: partners-api/src/routes/eventShop.ts:2229
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

483. POST /api/manage/:id/shop/orders/:orderId/claim-exception

• Purpose: POST /api/manage/:id/shop/orders/:orderId/claim-exception is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/claim-exception.
• Source: partners-api/src/routes/eventShop.ts:2304
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/claim-exception" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/claim-exception", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

484. POST /api/manage/:id/shop/orders/:orderId/payment-review

• Purpose: POST /api/manage/:id/shop/orders/:orderId/payment-review is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/payment-review.
• Source: partners-api/src/routes/eventShop.ts:2120
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

485. POST /api/manage/:id/shop/orders/:orderId/status

• Purpose: POST /api/manage/:id/shop/orders/:orderId/status is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/status.
• Source: partners-api/src/routes/eventShop.ts:2063
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/status", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

486. POST /api/manage/:id/shop/orders/:orderId/updates

• Purpose: POST /api/manage/:id/shop/orders/:orderId/updates is the Event Management compatibility alias for /api/events/:id/shop/orders/:orderId/updates.
• Source: partners-api/src/routes/eventShop.ts:2183
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, orderId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/shop/orders/:orderId/updates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/:orderId/updates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

487. GET /api/manage/:id/shop/orders/dashboard

• Purpose: GET /api/manage/:id/shop/orders/dashboard is the Event Management compatibility alias for /api/events/:id/shop/orders/dashboard.
• Source: partners-api/src/routes/eventShop.ts:1924
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/orders/dashboard" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/orders/dashboard", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

488. GET /api/manage/:id/shop/public

• Purpose: GET /api/manage/:id/shop/public is the Event Management compatibility alias for /api/events/:id/shop/public.
• Source: partners-api/src/routes/eventShop.ts:1271
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/public" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/public", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

489. GET /api/manage/:id/shop/source-items

• Purpose: GET /api/manage/:id/shop/source-items is the Event Management compatibility alias for /api/events/:id/shop/source-items.
• Source: partners-api/src/routes/eventShop.ts:1319
• Mounted prefix: /api
• Route module: eventShop.ts
• Router variable: api
• Stability: partner dashboard internal; alias
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/shop/source-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/shop/source-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

490. GET /api/partners/:partnerId/finance/access

• Purpose: GET /api/partners/:partnerId/finance/access handled by partnerFinance.ts; partners partnerId finance access route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:325
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

491. GET /api/partners/:partnerId/finance/accounts

• Purpose: GET /api/partners/:partnerId/finance/accounts handled by partnerFinance.ts; partners partnerId finance accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:347
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

492. GET /api/partners/:partnerId/finance/audit

• Purpose: GET /api/partners/:partnerId/finance/audit handled by partnerFinance.ts; partners partnerId finance audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1717
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

493. PUT /api/partners/:partnerId/finance/cash-accounts

• Purpose: PUT /api/partners/:partnerId/finance/cash-accounts handled by partnerFinance.ts; partners partnerId finance cash accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:371
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/cash-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/cash-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

494. GET /api/partners/:partnerId/finance/continuity-runs

• Purpose: GET /api/partners/:partnerId/finance/continuity-runs handled by partnerFinance.ts; partners partnerId finance continuity runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1383
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/continuity-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/continuity-runs", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

495. POST /api/partners/:partnerId/finance/continuity-runs

• Purpose: POST /api/partners/:partnerId/finance/continuity-runs handled by partnerFinance.ts; partners partnerId finance continuity runs route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1392
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/continuity-runs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/continuity-runs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

496. GET /api/partners/:partnerId/finance/controls

• Purpose: GET /api/partners/:partnerId/finance/controls handled by partnerFinance.ts; partners partnerId finance controls route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1374
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/controls" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/controls", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

497. GET /api/partners/:partnerId/finance/counterparties

• Purpose: GET /api/partners/:partnerId/finance/counterparties handled by partnerFinance.ts; partners partnerId finance counterparties route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:974
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/counterparties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/counterparties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

498. POST /api/partners/:partnerId/finance/counterparties

• Purpose: POST /api/partners/:partnerId/finance/counterparties handled by partnerFinance.ts; partners partnerId finance counterparties route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:991
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/counterparties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/counterparties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

499. GET /api/partners/:partnerId/finance/custody-sessions

• Purpose: GET /api/partners/:partnerId/finance/custody-sessions handled by partnerFinance.ts; partners partnerId finance custody sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1199
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

500. POST /api/partners/:partnerId/finance/custody-sessions

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions handled by partnerFinance.ts; partners partnerId finance custody sessions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1208
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

501. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId accept handover route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1275
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/accept-handover", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

502. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/close

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/close handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1295
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

503. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/handover

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/handover handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId handover route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1253
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/handover", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

504. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/movements

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/movements handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId movements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1229
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/movements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

505. POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close

• Purpose: POST /api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close handled by partnerFinance.ts; partners partnerId finance custody sessions sessionId review close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1317
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, sessionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/custody-sessions/:sessionId/review-close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

506. GET /api/partners/:partnerId/finance/default-payment-accounts

• Purpose: GET /api/partners/:partnerId/finance/default-payment-accounts handled by partnerFinance.ts; partners partnerId finance default payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:428
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/default-payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/default-payment-accounts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

507. PUT /api/partners/:partnerId/finance/default-payment-accounts

• Purpose: PUT /api/partners/:partnerId/finance/default-payment-accounts handled by partnerFinance.ts; partners partnerId finance default payment accounts route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:458
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/default-payment-accounts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/default-payment-accounts", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

508. GET /api/partners/:partnerId/finance/disbursements

• Purpose: GET /api/partners/:partnerId/finance/disbursements handled by partnerFinance.ts; partners partnerId finance disbursements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:726
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/disbursements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

509. POST /api/partners/:partnerId/finance/disbursements

• Purpose: POST /api/partners/:partnerId/finance/disbursements handled by partnerFinance.ts; partners partnerId finance disbursements route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1509
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/disbursements" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

510. POST /api/partners/:partnerId/finance/disbursements/:requestId/actions

• Purpose: POST /api/partners/:partnerId/finance/disbursements/:requestId/actions handled by partnerFinance.ts; partners partnerId finance disbursements requestId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1550
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, requestId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/disbursements/:requestId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/disbursements/:requestId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

511. POST /api/partners/:partnerId/finance/entries

• Purpose: POST /api/partners/:partnerId/finance/entries handled by partnerFinance.ts; partners partnerId finance entries route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:587
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

512. POST /api/partners/:partnerId/finance/entries/:entryId/allocations

• Purpose: POST /api/partners/:partnerId/finance/entries/:entryId/allocations handled by partnerFinance.ts; partners partnerId finance entries entryId allocations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:642
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries/:entryId/allocations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries/:entryId/allocations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

513. POST /api/partners/:partnerId/finance/entries/:entryId/reverse

• Purpose: POST /api/partners/:partnerId/finance/entries/:entryId/reverse handled by partnerFinance.ts; partners partnerId finance entries entryId reverse route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:623
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/entries/:entryId/reverse" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/entries/:entryId/reverse", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

514. GET /api/partners/:partnerId/finance/events

• Purpose: GET /api/partners/:partnerId/finance/events handled by partnerFinance.ts; partners partnerId finance events route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:669
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

515. POST /api/partners/:partnerId/finance/evidence

• Purpose: POST /api/partners/:partnerId/finance/evidence handled by partnerFinance.ts; partners partnerId finance evidence route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1054
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/evidence" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/evidence", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

516. POST /api/partners/:partnerId/finance/evidence/:evidenceId/access

• Purpose: POST /api/partners/:partnerId/finance/evidence/:evidenceId/access handled by partnerFinance.ts; partners partnerId finance evidence evidenceId access route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1106
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, evidenceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/evidence/:evidenceId/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/evidence/:evidenceId/access", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

517. GET /api/partners/:partnerId/finance/export.csv

• Purpose: GET /api/partners/:partnerId/finance/export.csv handled by partnerFinance.ts; partners partnerId finance export.csv route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1743
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/export.csv" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/export.csv", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

518. GET /api/partners/:partnerId/finance/history

• Purpose: GET /api/partners/:partnerId/finance/history handled by partnerFinance.ts; partners partnerId finance history route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:499
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

519. GET /api/partners/:partnerId/finance/history/:entryId

• Purpose: GET /api/partners/:partnerId/finance/history/:entryId handled by partnerFinance.ts; partners partnerId finance history entryId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:554
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/history/:entryId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/history/:entryId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

520. GET /api/partners/:partnerId/finance/imports

• Purpose: GET /api/partners/:partnerId/finance/imports handled by partnerFinance.ts; partners partnerId finance imports route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:742
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/imports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/imports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

521. GET /api/partners/:partnerId/finance/imports/:batchId/rows

• Purpose: GET /api/partners/:partnerId/finance/imports/:batchId/rows handled by partnerFinance.ts; partners partnerId finance imports batchId rows route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:752
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, batchId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/imports/:batchId/rows" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/imports/:batchId/rows", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

522. GET /api/partners/:partnerId/finance/integrations/health

• Purpose: GET /api/partners/:partnerId/finance/integrations/health handled by partnerFinance.ts; partners partnerId finance integrations health route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1336
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/integrations/health" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/integrations/health", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

523. POST /api/partners/:partnerId/finance/integrations/profiles

• Purpose: POST /api/partners/:partnerId/finance/integrations/profiles handled by partnerFinance.ts; partners partnerId finance integrations profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1353
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/integrations/profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/integrations/profiles", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

524. GET /api/partners/:partnerId/finance/interchange/export

• Purpose: GET /api/partners/:partnerId/finance/interchange/export handled by partnerFinance.ts; partners partnerId finance interchange export route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:854
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/interchange/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

525. GET /api/partners/:partnerId/finance/interchange/profiles

• Purpose: GET /api/partners/:partnerId/finance/interchange/profiles handled by partnerFinance.ts; partners partnerId finance interchange profiles route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:834
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/interchange/profiles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/profiles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

526. POST /api/partners/:partnerId/finance/interchange/ubl-invoice-preview

• Purpose: POST /api/partners/:partnerId/finance/interchange/ubl-invoice-preview handled by partnerFinance.ts; partners partnerId finance interchange ubl invoice preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:840
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/interchange/ubl-invoice-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/interchange/ubl-invoice-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

527. GET /api/partners/:partnerId/finance/notifications/destinations

• Purpose: GET /api/partners/:partnerId/finance/notifications/destinations handled by partnerFinance.ts; partners partnerId finance notifications destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1638
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/destinations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

528. PUT /api/partners/:partnerId/finance/notifications/destinations

• Purpose: PUT /api/partners/:partnerId/finance/notifications/destinations handled by partnerFinance.ts; partners partnerId finance notifications destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1652
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/partners/:partnerId/finance/notifications/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/destinations", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

529. GET /api/partners/:partnerId/finance/notifications/discord-channels

• Purpose: GET /api/partners/:partnerId/finance/notifications/discord-channels handled by partnerFinance.ts; partners partnerId finance notifications discord channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1621
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/discord-channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/discord-channels", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

530. GET /api/partners/:partnerId/finance/notifications/options

• Purpose: GET /api/partners/:partnerId/finance/notifications/options handled by partnerFinance.ts; partners partnerId finance notifications options route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1598
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/notifications/options" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/notifications/options", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

531. GET /api/partners/:partnerId/finance/periods

• Purpose: GET /api/partners/:partnerId/finance/periods handled by partnerFinance.ts; partners partnerId finance periods route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:932
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/periods" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

532. POST /api/partners/:partnerId/finance/periods/:periodId/close

• Purpose: POST /api/partners/:partnerId/finance/periods/:periodId/close handled by partnerFinance.ts; partners partnerId finance periods periodId close route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:941
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, periodId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/periods/:periodId/close" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods/:periodId/close", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

533. POST /api/partners/:partnerId/finance/periods/:periodId/reopen

• Purpose: POST /api/partners/:partnerId/finance/periods/:periodId/reopen handled by partnerFinance.ts; partners partnerId finance periods periodId reopen route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:958
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, periodId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/periods/:periodId/reopen" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/periods/:periodId/reopen", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

534. GET /api/partners/:partnerId/finance/reconciliation-status

• Purpose: GET /api/partners/:partnerId/finance/reconciliation-status handled by partnerFinance.ts; partners partnerId finance reconciliation status route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:915
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/reconciliation-status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliation-status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

535. GET /api/partners/:partnerId/finance/reconciliations

• Purpose: GET /api/partners/:partnerId/finance/reconciliations handled by partnerFinance.ts; partners partnerId finance reconciliations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:881
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

536. POST /api/partners/:partnerId/finance/reconciliations

• Purpose: POST /api/partners/:partnerId/finance/reconciliations handled by partnerFinance.ts; partners partnerId finance reconciliations route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:890
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

537. POST /api/partners/:partnerId/finance/reconciliations/import-preview

• Purpose: POST /api/partners/:partnerId/finance/reconciliations/import-preview handled by partnerFinance.ts; partners partnerId finance reconciliations import preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:794
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/reconciliations/import-preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/reconciliations/import-preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

538. GET /api/partners/:partnerId/finance/records

• Purpose: GET /api/partners/:partnerId/finance/records handled by partnerFinance.ts; partners partnerId finance records route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1012
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

539. POST /api/partners/:partnerId/finance/records

• Purpose: POST /api/partners/:partnerId/finance/records handled by partnerFinance.ts; partners partnerId finance records route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1128
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/records" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

540. GET /api/partners/:partnerId/finance/records/:recordId

• Purpose: GET /api/partners/:partnerId/finance/records/:recordId handled by partnerFinance.ts; partners partnerId finance records recordId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1027
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/records/:recordId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records/:recordId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

541. POST /api/partners/:partnerId/finance/records/:recordId/actions

• Purpose: POST /api/partners/:partnerId/finance/records/:recordId/actions handled by partnerFinance.ts; partners partnerId finance records recordId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1165
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, recordId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/records/:recordId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/records/:recordId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

542. GET /api/partners/:partnerId/finance/summary

• Purpose: GET /api/partners/:partnerId/finance/summary handled by partnerFinance.ts; partners partnerId finance summary route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:331
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/finance/summary" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/summary", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

543. POST /api/partners/:partnerId/finance/work-locks

• Purpose: POST /api/partners/:partnerId/finance/work-locks handled by partnerFinance.ts; partners partnerId finance work locks route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1444
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/work-locks" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

544. DELETE /api/partners/:partnerId/finance/work-locks/:lockId

• Purpose: DELETE /api/partners/:partnerId/finance/work-locks/:lockId handled by partnerFinance.ts; partners partnerId finance work locks lockId route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1494
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, lockId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/partners/:partnerId/finance/work-locks/:lockId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks/:lockId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

545. POST /api/partners/:partnerId/finance/work-locks/:lockId/heartbeat

• Purpose: POST /api/partners/:partnerId/finance/work-locks/:lockId/heartbeat handled by partnerFinance.ts; partners partnerId finance work locks lockId heartbeat route contract must be verified against source before integration.
• Source: partners-api/src/routes/partnerFinance.ts:1479
• Mounted prefix: /api
• Route module: partnerFinance.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, lockId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/finance/work-locks/:lockId/heartbeat", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

546. GET /api/partners/:partnerId/operations-linkage/access

• Purpose: GET /api/partners/:partnerId/operations-linkage/access handled by operationsLinkage.ts; partners partnerId operations linkage access route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:513
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/access" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/access", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

547. GET /api/partners/:partnerId/operations-linkage/coverage

• Purpose: GET /api/partners/:partnerId/operations-linkage/coverage handled by operationsLinkage.ts; partners partnerId operations linkage coverage route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:519
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/coverage" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/coverage", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

548. GET /api/partners/:partnerId/operations-linkage/deployments

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments handled by operationsLinkage.ts; partners partnerId operations linkage deployments route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1023
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

549. POST /api/partners/:partnerId/operations-linkage/deployments

• Purpose: POST /api/partners/:partnerId/operations-linkage/deployments handled by operationsLinkage.ts; partners partnerId operations linkage deployments route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1053
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

550. GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1111
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

551. POST /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1234
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

552. GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest

• Purpose: GET /api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest handled by operationsLinkage.ts; partners partnerId operations linkage deployments deploymentId manifest route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1178
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, deploymentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/deployments/:deploymentId/manifest", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

553. GET /api/partners/:partnerId/operations-linkage/dimensions

• Purpose: GET /api/partners/:partnerId/operations-linkage/dimensions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:782
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

554. POST /api/partners/:partnerId/operations-linkage/dimensions

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions handled by operationsLinkage.ts; partners partnerId operations linkage dimensions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:878
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

555. POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage dimensions dimensionId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:970
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, dimensionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/dimensions/:dimensionId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

556. GET /api/partners/:partnerId/operations-linkage/exceptions

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1505
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

557. POST /api/partners/:partnerId/operations-linkage/exceptions

• Purpose: POST /api/partners/:partnerId/operations-linkage/exceptions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1539
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

558. GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId

• Purpose: GET /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1524
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

559. POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions handled by operationsLinkage.ts; partners partnerId operations linkage exceptions exceptionId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1598
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, exceptionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/exceptions/:exceptionId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

560. GET /api/partners/:partnerId/operations-linkage/finance/asset-batches

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/asset-batches handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1400
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

561. POST /api/partners/:partnerId/operations-linkage/finance/asset-batches

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-batches handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1413
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

562. POST /api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance asset batches batchId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1448
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, batchId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/asset-batches/:batchId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

563. GET /api/partners/:partnerId/operations-linkage/finance/coding-proposals

• Purpose: GET /api/partners/:partnerId/operations-linkage/finance/coding-proposals handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1313
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

564. POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1326
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

565. POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions handled by operationsLinkage.ts; partners partnerId operations linkage finance coding proposals proposalId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1363
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, proposalId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/finance/coding-proposals/:proposalId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

566. GET /api/partners/:partnerId/operations-linkage/links

• Purpose: GET /api/partners/:partnerId/operations-linkage/links handled by operationsLinkage.ts; partners partnerId operations linkage links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:606
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

567. POST /api/partners/:partnerId/operations-linkage/links

• Purpose: POST /api/partners/:partnerId/operations-linkage/links handled by operationsLinkage.ts; partners partnerId operations linkage links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:652
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

568. PATCH /api/partners/:partnerId/operations-linkage/links/:linkId

• Purpose: PATCH /api/partners/:partnerId/operations-linkage/links/:linkId handled by operationsLinkage.ts; partners partnerId operations linkage links linkId route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:756
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/:linkId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/:linkId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

569. POST /api/partners/:partnerId/operations-linkage/links/:linkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/links/:linkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage links linkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:755
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/:linkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/:linkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

570. GET /api/partners/:partnerId/operations-linkage/links/candidates

• Purpose: GET /api/partners/:partnerId/operations-linkage/links/candidates handled by operationsLinkage.ts; partners partnerId operations linkage links candidates route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:625
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/links/candidates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/links/candidates", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

571. GET /api/partners/:partnerId/operations-linkage/parties

• Purpose: GET /api/partners/:partnerId/operations-linkage/parties handled by operationsLinkage.ts; partners partnerId operations linkage parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:780
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

572. POST /api/partners/:partnerId/operations-linkage/parties

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties handled by operationsLinkage.ts; partners partnerId operations linkage parties route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:808
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

573. POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:968
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

574. POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage parties partyId system links systemLinkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1020
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, partyId, systemLinkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/parties/:partyId/system-links/:systemLinkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

575. GET /api/partners/:partnerId/operations-linkage/places

• Purpose: GET /api/partners/:partnerId/operations-linkage/places handled by operationsLinkage.ts; partners partnerId operations linkage places route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:781
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

576. POST /api/partners/:partnerId/operations-linkage/places

• Purpose: POST /api/partners/:partnerId/operations-linkage/places handled by operationsLinkage.ts; partners partnerId operations linkage places route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:842
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

577. POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links

• Purpose: POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links handled by operationsLinkage.ts; partners partnerId operations linkage places placeId system links route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:969
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId/system-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId/system-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

578. POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions

• Purpose: POST /api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions handled by operationsLinkage.ts; partners partnerId operations linkage places placeId system links systemLinkId actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1021
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, placeId, systemLinkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/places/:placeId/system-links/:systemLinkId/actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

579. GET /api/partners/:partnerId/operations-linkage/search

• Purpose: GET /api/partners/:partnerId/operations-linkage/search handled by operationsLinkage.ts; partners partnerId operations linkage search route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1647
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

580. GET /api/partners/:partnerId/operations-linkage/timeline

• Purpose: GET /api/partners/:partnerId/operations-linkage/timeline handled by operationsLinkage.ts; partners partnerId operations linkage timeline route contract must be verified against source before integration.
• Source: partners-api/src/routes/operationsLinkage.ts:1719
• Mounted prefix: /api
• Route module: operationsLinkage.ts
• Router variable: routes
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/partners/:partnerId/operations-linkage/timeline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/partners/:partnerId/operations-linkage/timeline", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

581. GET /api/pawsports

• Purpose: GET /api/pawsports handled by pawsports.ts; pawsports route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:392
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/pawsports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

582. DELETE /api/pawsports/:id

• Purpose: DELETE /api/pawsports/:id handled by pawsports.ts; pawsports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:878
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

583. PATCH /api/pawsports/:id

• Purpose: PATCH /api/pawsports/:id handled by pawsports.ts; pawsports id route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:808
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/pawsports/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

584. POST /api/pawsports/:id/notes

• Purpose: POST /api/pawsports/:id/notes handled by pawsports.ts; pawsports id notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:894
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

585. DELETE /api/pawsports/:id/notes/:noteId

• Purpose: DELETE /api/pawsports/:id/notes/:noteId handled by pawsports.ts; pawsports id notes noteId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:963
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, noteId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id/notes/:noteId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes/:noteId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

586. PATCH /api/pawsports/:id/notes/:noteId

• Purpose: PATCH /api/pawsports/:id/notes/:noteId handled by pawsports.ts; pawsports id notes noteId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:929
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, noteId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/pawsports/:id/notes/:noteId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/notes/:noteId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

587. POST /api/pawsports/:id/reassign

• Purpose: POST /api/pawsports/:id/reassign handled by pawsports.ts; pawsports id reassign route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1054
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/reassign" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/reassign", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

588. POST /api/pawsports/:id/reissue

• Purpose: POST /api/pawsports/:id/reissue handled by pawsports.ts; pawsports id reissue route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:633
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/reissue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/reissue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

589. POST /api/pawsports/:id/restore

• Purpose: POST /api/pawsports/:id/restore handled by pawsports.ts; pawsports id restore route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:981
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/restore" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/restore", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

590. POST /api/pawsports/:id/revoke

• Purpose: POST /api/pawsports/:id/revoke handled by pawsports.ts; pawsports id revoke route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:600
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/revoke" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/revoke", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

591. POST /api/pawsports/:id/stamps

• Purpose: POST /api/pawsports/:id/stamps handled by pawsports.ts; pawsports id stamps route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:752
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/stamps" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/stamps", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

592. DELETE /api/pawsports/:id/stamps/:stampId

• Purpose: DELETE /api/pawsports/:id/stamps/:stampId handled by pawsports.ts; pawsports id stamps stampId route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:790
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, stampId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/pawsports/:id/stamps/:stampId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/stamps/:stampId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

593. POST /api/pawsports/:id/unbind

• Purpose: POST /api/pawsports/:id/unbind handled by pawsports.ts; pawsports id unbind route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1022
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/:id/unbind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/:id/unbind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

594. GET /api/pawsports/attendees/lookup

• Purpose: GET /api/pawsports/attendees/lookup handled by pawsports.ts; pawsports attendees lookup route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:357
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/pawsports/attendees/lookup" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/attendees/lookup", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

595. POST /api/pawsports/bind

• Purpose: POST /api/pawsports/bind handled by pawsports.ts; pawsports bind route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:596
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/bind" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/bind", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

596. POST /api/pawsports/issue

• Purpose: POST /api/pawsports/issue handled by pawsports.ts; pawsports issue route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:481
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/pawsports/issue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/pawsports/issue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

597. GET /api/planning/artifacts/:artifactId/content

• Purpose: GET /api/planning/artifacts/:artifactId/content handled by planning.ts; planning artifacts artifactId content route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2541
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/artifacts/:artifactId/content" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/artifacts/:artifactId/content", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

598. GET /api/planning/meta

• Purpose: GET /api/planning/meta handled by planning.ts; planning meta route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:945
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/meta" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/meta", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

599. GET /api/planning/my-work

• Purpose: GET /api/planning/my-work handled by planning.ts; planning my work route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1058
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/my-work" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/my-work", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

600. GET /api/planning/openapi.json

• Purpose: GET /api/planning/openapi.json handled by planning.ts; planning openapi.json route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:109
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/openapi.json" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/openapi.json", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

601. GET /api/planning/projects

• Purpose: GET /api/planning/projects handled by planning.ts; planning projects route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:954
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

602. POST /api/planning/projects

• Purpose: POST /api/planning/projects handled by planning.ts; planning projects route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:986
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

603. GET /api/planning/projects/:projectId

• Purpose: GET /api/planning/projects/:projectId handled by planning.ts; planning projects projectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1425
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

604. PATCH /api/planning/projects/:projectId

• Purpose: PATCH /api/planning/projects/:projectId handled by planning.ts; planning projects projectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1694
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

605. POST /api/planning/projects/:projectId/:collection

• Purpose: POST /api/planning/projects/:projectId/:collection handled by planning.ts; planning projects projectId collection route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3155
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/:collection" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/:collection", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

606. PATCH /api/planning/projects/:projectId/:collection/:resourceId

• Purpose: PATCH /api/planning/projects/:projectId/:collection/:resourceId handled by planning.ts; planning projects projectId collection resourceId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3201
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection, resourceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId/:collection/:resourceId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/:collection/:resourceId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

607. POST /api/planning/projects/:projectId/agenda-templates

• Purpose: POST /api/planning/projects/:projectId/agenda-templates handled by planning.ts; planning projects projectId agenda templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2953
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/agenda-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/agenda-templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

608. POST /api/planning/projects/:projectId/artifacts

• Purpose: POST /api/planning/projects/:projectId/artifacts handled by planning.ts; planning projects projectId artifacts route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2474
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

609. PATCH /api/planning/projects/:projectId/artifacts/:artifactId/controls

• Purpose: PATCH /api/planning/projects/:projectId/artifacts/:artifactId/controls handled by planning.ts; planning projects projectId artifacts artifactId controls route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2595
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/controls" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/controls", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

610. POST /api/planning/projects/:projectId/artifacts/:artifactId/review

• Purpose: POST /api/planning/projects/:projectId/artifacts/:artifactId/review handled by planning.ts; planning projects projectId artifacts artifactId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2577
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

611. POST /api/planning/projects/:projectId/artifacts/:artifactId/versions

• Purpose: POST /api/planning/projects/:projectId/artifacts/:artifactId/versions handled by planning.ts; planning projects projectId artifacts artifactId versions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2522
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, artifactId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/artifacts/:artifactId/versions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/artifacts/:artifactId/versions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

612. GET /api/planning/projects/:projectId/audit

• Purpose: GET /api/planning/projects/:projectId/audit handled by planning.ts; planning projects projectId audit route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3041
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/audit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/audit", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

613. POST /api/planning/projects/:projectId/baselines

• Purpose: POST /api/planning/projects/:projectId/baselines handled by planning.ts; planning projects projectId baselines route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1996
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/baselines" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/baselines", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

614. GET /api/planning/projects/:projectId/bootstrap

• Purpose: GET /api/planning/projects/:projectId/bootstrap handled by planning.ts; planning projects projectId bootstrap route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1217
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/bootstrap" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/bootstrap", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

615. GET /api/planning/projects/:projectId/calendar.ics

• Purpose: GET /api/planning/projects/:projectId/calendar.ics handled by planning.ts; planning projects projectId calendar.ics route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1588
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/calendar.ics" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/calendar.ics", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

616. GET /api/planning/projects/:projectId/calendar.jscalendar

• Purpose: GET /api/planning/projects/:projectId/calendar.jscalendar handled by planning.ts; planning projects projectId calendar.jscalendar route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1653
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/calendar.jscalendar" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/calendar.jscalendar", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

617. POST /api/planning/projects/:projectId/canonical-command

• Purpose: POST /api/planning/projects/:projectId/canonical-command handled by planning.ts; planning projects projectId canonical command route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2390
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/canonical-command" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/canonical-command", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

618. GET /api/planning/projects/:projectId/change-sets

• Purpose: GET /api/planning/projects/:projectId/change-sets handled by planning.ts; planning projects projectId change sets route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2276
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/change-sets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

619. POST /api/planning/projects/:projectId/change-sets

• Purpose: POST /api/planning/projects/:projectId/change-sets handled by planning.ts; planning projects projectId change sets route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2292
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

620. POST /api/planning/projects/:projectId/change-sets/:changeSetId/apply

• Purpose: POST /api/planning/projects/:projectId/change-sets/:changeSetId/apply handled by planning.ts; planning projects projectId change sets changeSetId apply route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2383
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, changeSetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets/:changeSetId/apply" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets/:changeSetId/apply", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

621. POST /api/planning/projects/:projectId/change-sets/:changeSetId/review

• Purpose: POST /api/planning/projects/:projectId/change-sets/:changeSetId/review handled by planning.ts; planning projects projectId change sets changeSetId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2346
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, changeSetId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/change-sets/:changeSetId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/change-sets/:changeSetId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

622. POST /api/planning/projects/:projectId/comments

• Purpose: POST /api/planning/projects/:projectId/comments handled by planning.ts; planning projects projectId comments route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3052
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/comments" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/comments", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

623. PUT /api/planning/projects/:projectId/comments/:commentId/reactions/:reaction

• Purpose: PUT /api/planning/projects/:projectId/comments/:commentId/reactions/:reaction handled by planning.ts; planning projects projectId comments commentId reactions reaction route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3077
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, commentId, reaction
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/comments/:commentId/reactions/:reaction", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

624. GET /api/planning/projects/:projectId/decision-participants

• Purpose: GET /api/planning/projects/:projectId/decision-participants handled by planning.ts; planning projects projectId decision participants route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2802
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/decision-participants" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/decision-participants", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

625. GET /api/planning/projects/:projectId/delivery-history

• Purpose: GET /api/planning/projects/:projectId/delivery-history handled by planningReminderChannels.ts; planning projects projectId delivery history route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:740
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/delivery-history" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/delivery-history", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

626. POST /api/planning/projects/:projectId/departments/:departmentId/memberships

• Purpose: POST /api/planning/projects/:projectId/departments/:departmentId/memberships handled by planning.ts; planning projects projectId departments departmentId memberships route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2859
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, departmentId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/departments/:departmentId/memberships" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/departments/:departmentId/memberships", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

627. POST /api/planning/projects/:projectId/dependencies

• Purpose: POST /api/planning/projects/:projectId/dependencies handled by planning.ts; planning projects projectId dependencies route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1849
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/dependencies" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/dependencies", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

628. DELETE /api/planning/projects/:projectId/dependencies/:dependencyId

• Purpose: DELETE /api/planning/projects/:projectId/dependencies/:dependencyId handled by planning.ts; planning projects projectId dependencies dependencyId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2028
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, dependencyId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/dependencies/:dependencyId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/dependencies/:dependencyId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

629. POST /api/planning/projects/:projectId/destinations

• Purpose: POST /api/planning/projects/:projectId/destinations handled by planning.ts; planning projects projectId destinations route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2418
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

630. POST /api/planning/projects/:projectId/destinations/:destinationId/rotate

• Purpose: POST /api/planning/projects/:projectId/destinations/:destinationId/rotate handled by planning.ts; planning projects projectId destinations destinationId rotate route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2930
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, destinationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations/:destinationId/rotate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations/:destinationId/rotate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

631. POST /api/planning/projects/:projectId/destinations/:destinationId/test

• Purpose: POST /api/planning/projects/:projectId/destinations/:destinationId/test handled by planning.ts; planning projects projectId destinations destinationId test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2457
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, destinationId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/destinations/:destinationId/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/destinations/:destinationId/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

632. GET /api/planning/projects/:projectId/event-catalog

• Purpose: GET /api/planning/projects/:projectId/event-catalog handled by planning.ts; planning projects projectId event catalog route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1739
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/event-catalog" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/event-catalog", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

633. POST /api/planning/projects/:projectId/exercises

• Purpose: POST /api/planning/projects/:projectId/exercises handled by planning.ts; planning projects projectId exercises route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2973
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/exercises" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/exercises", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

634. POST /api/planning/projects/:projectId/gates/:gateId/decisions

• Purpose: POST /api/planning/projects/:projectId/gates/:gateId/decisions handled by planning.ts; planning projects projectId gates gateId decisions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3001
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, gateId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/gates/:gateId/decisions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/gates/:gateId/decisions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

635. POST /api/planning/projects/:projectId/handoffs

• Purpose: POST /api/planning/projects/:projectId/handoffs handled by planning.ts; planning projects projectId handoffs route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3019
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/handoffs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/handoffs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

636. GET /api/planning/projects/:projectId/handoffs/:handoffId/export

• Purpose: GET /api/planning/projects/:projectId/handoffs/:handoffId/export handled by planning.ts; planning projects projectId handoffs handoffId export route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3035
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, handoffId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/handoffs/:handoffId/export" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/handoffs/:handoffId/export", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

637. POST /api/planning/projects/:projectId/imports

• Purpose: POST /api/planning/projects/:projectId/imports handled by planning.ts; planning projects projectId imports route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3129
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/imports" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/imports", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

638. POST /api/planning/projects/:projectId/link-event

• Purpose: POST /api/planning/projects/:projectId/link-event handled by planning.ts; planning projects projectId link event route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1719
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/link-event" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/link-event", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

639. GET /api/planning/projects/:projectId/meetings/:meetingId

• Purpose: GET /api/planning/projects/:projectId/meetings/:meetingId handled by planning.ts; planning projects projectId meetings meetingId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1674
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

640. POST /api/planning/projects/:projectId/meetings/:meetingId/agenda

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/agenda handled by planning.ts; planning projects projectId meetings meetingId agenda route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2139
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/agenda" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/agenda", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

641. POST /api/planning/projects/:projectId/meetings/:meetingId/agenda/state

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/agenda/state handled by planning.ts; planning projects projectId meetings meetingId agenda state route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2166
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/agenda/state" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/agenda/state", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

642. POST /api/planning/projects/:projectId/meetings/:meetingId/minutes

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/minutes handled by planning.ts; planning projects projectId meetings meetingId minutes route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2172
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/minutes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/minutes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

643. POST /api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions handled by planning.ts; planning projects projectId meetings meetingId minutes with actions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2199
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/minutes-with-actions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

644. POST /api/planning/projects/:projectId/meetings/:meetingId/notes

• Purpose: POST /api/planning/projects/:projectId/meetings/:meetingId/notes handled by planning.ts; planning projects projectId meetings meetingId notes route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3093
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/notes" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/notes", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

645. PUT /api/planning/projects/:projectId/meetings/:meetingId/rsvp

• Purpose: PUT /api/planning/projects/:projectId/meetings/:meetingId/rsvp handled by planning.ts; planning projects projectId meetings meetingId rsvp route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3084
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, meetingId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/meetings/:meetingId/rsvp" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/meetings/:meetingId/rsvp", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

646. GET /api/planning/projects/:projectId/member-directory

• Purpose: GET /api/planning/projects/:projectId/member-directory handled by planning.ts; planning projects projectId member directory route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2766
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/member-directory" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/member-directory", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

647. GET /api/planning/projects/:projectId/my-reminder-channels

• Purpose: GET /api/planning/projects/:projectId/my-reminder-channels handled by planningReminderChannels.ts; planning projects projectId my reminder channels route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:276
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

648. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/start

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/start handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm start route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:408
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

649. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:411
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

650. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:431
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

651. POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels discord_dm verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:409
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/discord_dm/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

652. POST /api/planning/projects/:projectId/my-reminder-channels/sms/opt-out

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/opt-out handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms opt out route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:709
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/opt-out", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

653. POST /api/planning/projects/:projectId/my-reminder-channels/sms/resend

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/resend handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms resend route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:615
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/resend" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/resend", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

654. POST /api/planning/projects/:projectId/my-reminder-channels/sms/start-verification

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/start-verification handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms start verification route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:610
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/start-verification", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

655. POST /api/planning/projects/:projectId/my-reminder-channels/sms/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:698
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

656. POST /api/planning/projects/:projectId/my-reminder-channels/sms/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:719
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

657. POST /api/planning/projects/:projectId/my-reminder-channels/sms/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/sms/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels sms verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:633
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/sms/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/sms/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

658. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm start route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:284
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

659. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm test route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:338
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/test", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

660. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:358
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

661. POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify

• Purpose: POST /api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify handled by planningReminderChannels.ts; planning projects projectId my reminder channels telegram_dm verify route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:329
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/my-reminder-channels/telegram_dm/verify", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

662. POST /api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile

• Purpose: POST /api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile handled by planningReminderChannels.ts; planning projects projectId notification outbox outboxId reconcile route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:769
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, outboxId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-outbox/:outboxId/reconcile", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

663. POST /api/planning/projects/:projectId/notification-outbox/:outboxId/retry

• Purpose: POST /api/planning/projects/:projectId/notification-outbox/:outboxId/retry handled by planningReminderChannels.ts; planning projects projectId notification outbox outboxId retry route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:754
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, outboxId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-outbox/:outboxId/retry" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-outbox/:outboxId/retry", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

664. PUT /api/planning/projects/:projectId/notification-preferences

• Purpose: PUT /api/planning/projects/:projectId/notification-preferences handled by planning.ts; planning projects projectId notification preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3104
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/notification-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-preferences", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

665. POST /api/planning/projects/:projectId/notification-rules

• Purpose: POST /api/planning/projects/:projectId/notification-rules handled by planning.ts; planning projects projectId notification rules route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2014
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/notification-rules" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/notification-rules", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

666. GET /api/planning/projects/:projectId/pages/:collection

• Purpose: GET /api/planning/projects/:projectId/pages/:collection handled by planning.ts; planning projects projectId pages collection route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1258
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, collection
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/pages/:collection" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/pages/:collection", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

667. POST /api/planning/projects/:projectId/requirement-packs/instantiate

• Purpose: POST /api/planning/projects/:projectId/requirement-packs/instantiate handled by planning.ts; planning projects projectId requirement packs instantiate route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2898
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirement-packs/instantiate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirement-packs/instantiate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

668. POST /api/planning/projects/:projectId/requirement-templates

• Purpose: POST /api/planning/projects/:projectId/requirement-templates handled by planning.ts; planning projects projectId requirement templates route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2888
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirement-templates" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirement-templates", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

669. PUT /api/planning/projects/:projectId/requirements/:requirementId/approval-flow

• Purpose: PUT /api/planning/projects/:projectId/requirements/:requirementId/approval-flow handled by planning.ts; planning projects projectId requirements requirementId approval flow route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2686
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/approval-flow" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/approval-flow", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

670. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions handled by planning.ts; planning projects projectId requirements requirementId submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2082
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

671. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review handled by planning.ts; planning projects projectId requirements requirementId submissions submissionId review route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2629
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

672. POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw handled by planning.ts; planning projects projectId requirements requirementId submissions submissionId withdraw route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2131
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId, submissionId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/submissions/:submissionId/withdraw", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

673. GET /api/planning/projects/:projectId/requirements/:requirementId/work-items

• Purpose: GET /api/planning/projects/:projectId/requirements/:requirementId/work-items handled by planning.ts; planning projects projectId requirements requirementId work items route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2042
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/work-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/work-items", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

674. POST /api/planning/projects/:projectId/requirements/:requirementId/work-items

• Purpose: POST /api/planning/projects/:projectId/requirements/:requirementId/work-items handled by planning.ts; planning projects projectId requirements requirementId work items route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2058
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, requirementId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/requirements/:requirementId/work-items" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/requirements/:requirementId/work-items", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

675. POST /api/planning/projects/:projectId/resource-links

• Purpose: POST /api/planning/projects/:projectId/resource-links handled by planning.ts; planning projects projectId resource links route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1798
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/resource-links" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/resource-links", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

676. DELETE /api/planning/projects/:projectId/resource-links/:linkId

• Purpose: DELETE /api/planning/projects/:projectId/resource-links/:linkId handled by planning.ts; planning projects projectId resource links linkId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1834
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, linkId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/resource-links/:linkId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/resource-links/:linkId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

677. POST /api/planning/projects/:projectId/risks/:riskId/lifecycle

• Purpose: POST /api/planning/projects/:projectId/risks/:riskId/lifecycle handled by planning.ts; planning projects projectId risks riskId lifecycle route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2729
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, riskId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/risks/:riskId/lifecycle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/risks/:riskId/lifecycle", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

678. POST /api/planning/projects/:projectId/saved-views

• Purpose: POST /api/planning/projects/:projectId/saved-views handled by planning.ts; planning projects projectId saved views route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3118
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/saved-views" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/saved-views", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

679. DELETE /api/planning/projects/:projectId/saved-views/:viewId

• Purpose: DELETE /api/planning/projects/:projectId/saved-views/:viewId handled by planning.ts; planning projects projectId saved views viewId route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3124
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, viewId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/planning/projects/:projectId/saved-views/:viewId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/saved-views/:viewId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

680. GET /api/planning/projects/:projectId/schedule-window

• Purpose: GET /api/planning/projects/:projectId/schedule-window handled by planning.ts; planning projects projectId schedule window route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1346
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/schedule-window" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/schedule-window", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

681. POST /api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token

• Purpose: POST /api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token handled by planningReminderChannels.ts; planning projects projectId sms gateway devices deviceId native token route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:779
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/sms-gateway/devices/:deviceId/native-token", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

682. GET /api/planning/projects/:projectId/usernames/search

• Purpose: GET /api/planning/projects/:projectId/usernames/search handled by planning.ts; planning projects projectId usernames search route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:2826
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/usernames/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/usernames/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

683. PUT /api/planning/projects/:projectId/watchers

• Purpose: PUT /api/planning/projects/:projectId/watchers handled by planning.ts; planning projects projectId watchers route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:3068
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/planning/projects/:projectId/watchers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/watchers", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

684. POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule handled by planning.ts; planning projects projectId work items workItemId reschedule route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1895
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/reschedule" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/reschedule", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

685. POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview handled by planning.ts; planning projects projectId work items workItemId reschedule preview route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1935
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/reschedule/preview", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

686. POST /api/planning/projects/:projectId/work-items/:workItemId/wbs-position

• Purpose: POST /api/planning/projects/:projectId/work-items/:workItemId/wbs-position handled by planning.ts; planning projects projectId work items workItemId wbs position route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1960
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId, workItemId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/projects/:projectId/work-items/:workItemId/wbs-position" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/work-items/:workItemId/wbs-position", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

687. GET /api/planning/projects/:projectId/workload-window

• Purpose: GET /api/planning/projects/:projectId/workload-window handled by planning.ts; planning projects projectId workload window route contract must be verified against source before integration.
• Source: partners-api/src/routes/planning.ts:1381
• Mounted prefix: /api
• Route module: planning.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: projectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/projects/:projectId/workload-window" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/projects/:projectId/workload-window", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

688. POST /api/planning/sms-gateway/devices/:deviceId/heartbeat

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/heartbeat handled by planningReminderChannels.ts; planning sms gateway devices deviceId heartbeat route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:849
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/heartbeat" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/heartbeat", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

689. POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt handled by planningReminderChannels.ts; planning sms gateway devices deviceId jobs jobId receipt route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:1014
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId, jobId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/receipt", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

690. POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck handled by planningReminderChannels.ts; planning sms gateway devices deviceId jobs jobId recheck route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:964
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId, jobId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/jobs/:jobId/recheck", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

691. POST /api/planning/sms-gateway/devices/:deviceId/lease

• Purpose: POST /api/planning/sms-gateway/devices/:deviceId/lease handled by planningReminderChannels.ts; planning sms gateway devices deviceId lease route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:873
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/lease" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/lease", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

692. GET /api/planning/sms-gateway/devices/:deviceId/preflight

• Purpose: GET /api/planning/sms-gateway/devices/:deviceId/preflight handled by planningReminderChannels.ts; planning sms gateway devices deviceId preflight route contract must be verified against source before integration.
• Source: partners-api/src/routes/planningReminderChannels.ts:834
• Mounted prefix: /api
• Route module: planningReminderChannels.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: deviceId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/planning/sms-gateway/devices/:deviceId/preflight" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/planning/sms-gateway/devices/:deviceId/preflight", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

693. GET /api/rego/events/:slug/feedback

• Purpose: GET /api/rego/events/:slug/feedback handled by eventFeedback.ts; rego events slug feedback route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:239
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/feedback" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/feedback", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

694. POST /api/rego/events/:slug/feedback/submissions

• Purpose: POST /api/rego/events/:slug/feedback/submissions handled by eventFeedback.ts; rego events slug feedback submissions route contract must be verified against source before integration.
• Source: partners-api/src/routes/eventFeedback.ts:276
• Mounted prefix: /api
• Route module: eventFeedback.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/events/:slug/feedback/submissions" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/feedback/submissions", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

695. GET /api/rego/pawsport

• Purpose: GET /api/rego/pawsport handled by pawsports.ts; rego pawsport route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1280
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/pawsport" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

696. POST /api/rego/pawsport/:id/lost

• Purpose: POST /api/rego/pawsport/:id/lost handled by pawsports.ts; rego pawsport id lost route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1230
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/pawsport/:id/lost" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport/:id/lost", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

697. POST /api/rego/pawsport/enroll

• Purpose: POST /api/rego/pawsport/enroll handled by pawsports.ts; rego pawsport enroll route contract must be verified against source before integration.
• Source: partners-api/src/routes/pawsports.ts:1134
• Mounted prefix: /api
• Route module: pawsports.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/pawsport/enroll" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/pawsport/enroll", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

698. GET /api/social-publishing/oauth/:network/callback

• Purpose: GET /api/social-publishing/oauth/:network/callback handled by socialPublishing.ts; social publishing oauth network callback route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:191
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: network
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social-publishing/oauth/:network/callback" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/oauth/:network/callback", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

699. POST /api/social-publishing/partners/:partnerId/accounts/:network/oauth/start

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/:network/oauth/start handled by socialPublishing.ts; social publishing partners partnerId accounts network oauth start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:164
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, network
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/:network/oauth/start", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

700. POST /api/social-publishing/partners/:partnerId/accounts/discord-webhook

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/discord-webhook handled by socialPublishing.ts; social publishing partners partnerId accounts discord webhook route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:271
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/discord-webhook" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/discord-webhook", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

701. POST /api/social-publishing/partners/:partnerId/accounts/telegram

• Purpose: POST /api/social-publishing/partners/:partnerId/accounts/telegram handled by socialPublishing.ts; social publishing partners partnerId accounts telegram route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:294
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/accounts/telegram" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/accounts/telegram", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

702. GET /api/social-publishing/partners/:partnerId/overview

• Purpose: GET /api/social-publishing/partners/:partnerId/overview handled by socialPublishing.ts; social publishing partners partnerId overview route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:237
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/social-publishing/partners/:partnerId/overview" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/overview", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

703. POST /api/social-publishing/partners/:partnerId/posts

• Purpose: POST /api/social-publishing/partners/:partnerId/posts handled by socialPublishing.ts; social publishing partners partnerId posts route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:315
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/posts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/posts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

704. POST /api/social-publishing/partners/:partnerId/posts/:postId/queue

• Purpose: POST /api/social-publishing/partners/:partnerId/posts/:postId/queue handled by socialPublishing.ts; social publishing partners partnerId posts postId queue route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialPublishing.ts:394
• Mounted prefix: /api
• Route module: socialPublishing.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: partnerId, postId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/social-publishing/partners/:partnerId/posts/:postId/queue" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/social-publishing/partners/:partnerId/posts/:postId/queue", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

705. POST /hooks/discord-finance

• Purpose: POST /hooks/discord-finance handled by financeInteractions.ts; hooks discord finance route contract must be verified against source before integration.
• Source: partners-api/src/routes/financeInteractions.ts:31
• Mounted prefix: /hooks
• Route module: financeInteractions.ts
• Router variable: routes
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May affect finance-adjacent records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/discord-finance" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/discord-finance", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/index/

706. GET /api/events/:id/group-rego-settings

• Purpose: GET /api/events/:id/group-rego-settings handled by groupRego.ts; events id group rego settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:819
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

707. PUT /api/events/:id/group-rego-settings

• Purpose: PUT /api/events/:id/group-rego-settings handled by groupRego.ts; events id group rego settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:843
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

708. GET /api/events/:id/rego-gifts

• Purpose: GET /api/events/:id/rego-gifts handled by rego.ts; events id rego gifts route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1925
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

709. POST /api/events/:id/rego-gifts/:giftId/payment-review

• Purpose: POST /api/events/:id/rego-gifts/:giftId/payment-review handled by rego.ts; events id rego gifts giftId payment review route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1947
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, giftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/rego-gifts/:giftId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts/:giftId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

710. POST /api/events/:id/reserve-slot

• Purpose: POST /api/events/:id/reserve-slot handled by regoReservations.ts; events id reserve slot route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoReservations.ts:20
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/reserve-slot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/reserve-slot", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

711. GET /api/events/:id/waitlist-config

• Purpose: GET /api/events/:id/waitlist-config handled by waitlist.ts; events id waitlist config route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:263
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/waitlist-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

712. PUT /api/events/:id/waitlist-config/:subjectType/:subjectId

• Purpose: PUT /api/events/:id/waitlist-config/:subjectType/:subjectId handled by waitlist.ts; events id waitlist config subjectType subjectId route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:298
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, subjectType, subjectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/waitlist-config/:subjectType/:subjectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config/:subjectType/:subjectId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

713. POST /api/events/:id/waitlist/process-next/:tierId

• Purpose: POST /api/events/:id/waitlist/process-next/:tierId handled by waitlist.ts; events id waitlist process next tierId route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:388
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, tierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/waitlist/process-next/:tierId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist/process-next/:tierId", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

714. POST /api/internal/waitlist/expire-offers

• Purpose: POST /api/internal/waitlist/expire-offers handled by waitlist.ts; internal waitlist expire offers route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:654
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/waitlist/expire-offers" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/waitlist/expire-offers", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

715. GET /api/manage/:id/group-rego-settings

• Purpose: GET /api/manage/:id/group-rego-settings is the Event Management compatibility alias for /api/events/:id/group-rego-settings.
• Source: partners-api/src/routes/groupRego.ts:819
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

716. PUT /api/manage/:id/group-rego-settings

• Purpose: PUT /api/manage/:id/group-rego-settings is the Event Management compatibility alias for /api/events/:id/group-rego-settings.
• Source: partners-api/src/routes/groupRego.ts:843
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/group-rego-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/group-rego-settings", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

717. GET /api/manage/:id/rego-gifts

• Purpose: GET /api/manage/:id/rego-gifts is the Event Management compatibility alias for /api/events/:id/rego-gifts.
• Source: partners-api/src/routes/rego.ts:1925
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/rego-gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

718. POST /api/manage/:id/rego-gifts/:giftId/payment-review

• Purpose: POST /api/manage/:id/rego-gifts/:giftId/payment-review is the Event Management compatibility alias for /api/events/:id/rego-gifts/:giftId/payment-review.
• Source: partners-api/src/routes/rego.ts:1947
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, giftId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/rego-gifts/:giftId/payment-review" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/rego-gifts/:giftId/payment-review", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

719. POST /api/manage/:id/reserve-slot

• Purpose: POST /api/manage/:id/reserve-slot is the Event Management compatibility alias for /api/events/:id/reserve-slot.
• Source: partners-api/src/routes/regoReservations.ts:20
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/reserve-slot" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/reserve-slot", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

720. GET /api/manage/:id/waitlist-config

• Purpose: GET /api/manage/:id/waitlist-config is the Event Management compatibility alias for /api/events/:id/waitlist-config.
• Source: partners-api/src/routes/waitlist.ts:263
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/waitlist-config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

721. PUT /api/manage/:id/waitlist-config/:subjectType/:subjectId

• Purpose: PUT /api/manage/:id/waitlist-config/:subjectType/:subjectId is the Event Management compatibility alias for /api/events/:id/waitlist-config/:subjectType/:subjectId.
• Source: partners-api/src/routes/waitlist.ts:298
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, subjectType, subjectId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/waitlist-config/:subjectType/:subjectId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist-config/:subjectType/:subjectId", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

722. POST /api/manage/:id/waitlist/process-next/:tierId

• Purpose: POST /api/manage/:id/waitlist/process-next/:tierId is the Event Management compatibility alias for /api/events/:id/waitlist/process-next/:tierId.
• Source: partners-api/src/routes/waitlist.ts:388
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, tierId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/waitlist/process-next/:tierId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/waitlist/process-next/:tierId", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

723. POST /api/rego-reservations/:id/release

• Purpose: POST /api/rego-reservations/:id/release handled by regoReservations.ts; rego reservations id release route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoReservations.ts:92
• Mounted prefix: /api
• Route module: regoReservations.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego-reservations/:id/release" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego-reservations/:id/release", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

724. GET /api/rego/affiliate-rewards

• Purpose: GET /api/rego/affiliate-rewards handled by regoAffiliateRewards.ts; rego affiliate rewards route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAffiliateRewards.ts:18
• Mounted prefix: /api
• Route module: regoAffiliateRewards.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/affiliate-rewards" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/affiliate-rewards", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

725. PUT /api/rego/affiliate-rewards/:affiliateId/payout

• Purpose: PUT /api/rego/affiliate-rewards/:affiliateId/payout handled by regoAffiliateRewards.ts; rego affiliate rewards affiliateId payout route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoAffiliateRewards.ts:30
• Mounted prefix: /api
• Route module: regoAffiliateRewards.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: affiliateId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/affiliate-rewards/:affiliateId/payout" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/affiliate-rewards/:affiliateId/payout", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

726. GET /api/rego/events

• Purpose: GET /api/rego/events handled by rego.ts; rego events route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1023
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

727. GET /api/rego/events/:slug

• Purpose: GET /api/rego/events/:slug handled by rego.ts; rego events slug route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1112
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

728. GET /api/rego/events/:slug/gift/recipient

• Purpose: GET /api/rego/events/:slug/gift/recipient handled by rego.ts; rego events slug gift recipient route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1450
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: slug
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/events/:slug/gift/recipient" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/events/:slug/gift/recipient", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

729. GET /api/rego/fursonas

• Purpose: GET /api/rego/fursonas handled by fursonas.ts; rego fursonas route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:69
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/fursonas" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

730. POST /api/rego/fursonas

• Purpose: POST /api/rego/fursonas handled by fursonas.ts; rego fursonas route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:90
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/fursonas" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

731. DELETE /api/rego/fursonas/:id

• Purpose: DELETE /api/rego/fursonas/:id handled by fursonas.ts; rego fursonas id route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:195
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/fursonas/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

732. PUT /api/rego/fursonas/:id

• Purpose: PUT /api/rego/fursonas/:id handled by fursonas.ts; rego fursonas id route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:136
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/fursonas/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

733. DELETE /api/rego/fursonas/:id/refs

• Purpose: DELETE /api/rego/fursonas/:id/refs handled by fursonas.ts; rego fursonas id refs route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:282
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/fursonas/:id/refs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

734. POST /api/rego/fursonas/:id/refs

• Purpose: POST /api/rego/fursonas/:id/refs handled by fursonas.ts; rego fursonas id refs route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:232
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/fursonas/:id/refs" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

735. PUT /api/rego/fursonas/:id/refs/latest

• Purpose: PUT /api/rego/fursonas/:id/refs/latest handled by fursonas.ts; rego fursonas id refs latest route contract must be verified against source before integration.
• Source: partners-api/src/routes/fursonas.ts:332
• Mounted prefix: /api
• Route module: fursonas.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/fursonas/:id/refs/latest" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/fursonas/:id/refs/latest", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

736. POST /api/rego/gifts

• Purpose: POST /api/rego/gifts handled by rego.ts; rego gifts route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1570
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

737. GET /api/rego/gifts/:id

• Purpose: GET /api/rego/gifts/:id handled by rego.ts; rego gifts id route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1894
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/gifts/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

738. POST /api/rego/gifts/:id/redeem

• Purpose: POST /api/rego/gifts/:id/redeem handled by rego.ts; rego gifts id redeem route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1917
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts/:id/redeem" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/:id/redeem", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

739. GET /api/rego/gifts/me

• Purpose: GET /api/rego/gifts/me handled by rego.ts; rego gifts me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1870
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/gifts/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

740. POST /api/rego/gifts/quote

• Purpose: POST /api/rego/gifts/quote handled by rego.ts; rego gifts quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1499
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/gifts/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/gifts/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

741. POST /api/rego/groups

• Purpose: POST /api/rego/groups handled by groupRego.ts; rego groups route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:245
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

742. GET /api/rego/groups/:id

• Purpose: GET /api/rego/groups/:id handled by groupRego.ts; rego groups id route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:397
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

743. PATCH /api/rego/groups/:id/accept

• Purpose: PATCH /api/rego/groups/:id/accept handled by groupRego.ts; rego groups id accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:552
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/accept", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

744. PATCH /api/rego/groups/:id/cancel

• Purpose: PATCH /api/rego/groups/:id/cancel handled by groupRego.ts; rego groups id cancel route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:566
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/cancel" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/cancel", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

745. PATCH /api/rego/groups/:id/decline

• Purpose: PATCH /api/rego/groups/:id/decline handled by groupRego.ts; rego groups id decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:559
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/decline", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

746. POST /api/rego/groups/:id/invite

• Purpose: POST /api/rego/groups/:id/invite handled by groupRego.ts; rego groups id invite route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:440
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups/:id/invite" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/invite", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

747. DELETE /api/rego/groups/:id/members/:memberId

• Purpose: DELETE /api/rego/groups/:id/members/:memberId handled by groupRego.ts; rego groups id members memberId route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:648
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, memberId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/groups/:id/members/:memberId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/members/:memberId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

748. PATCH /api/rego/groups/:id/members/:memberId

• Purpose: PATCH /api/rego/groups/:id/members/:memberId handled by groupRego.ts; rego groups id members memberId route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:598
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, memberId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/groups/:id/members/:memberId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/members/:memberId", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

749. POST /api/rego/groups/:id/submit

• Purpose: POST /api/rego/groups/:id/submit handled by rego.ts; rego groups id submit route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:3160
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/groups/:id/submit" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/submit", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

750. GET /api/rego/groups/:id/totals

• Purpose: GET /api/rego/groups/:id/totals handled by groupRego.ts; rego groups id totals route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:685
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/:id/totals" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/:id/totals", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

751. GET /api/rego/groups/my

• Purpose: GET /api/rego/groups/my handled by groupRego.ts; rego groups my route contract must be verified against source before integration.
• Source: partners-api/src/routes/groupRego.ts:339
• Mounted prefix: /api
• Route module: groupRego.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/groups/my" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/groups/my", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

752. POST /api/rego/internal/archive-expired

• Purpose: POST /api/rego/internal/archive-expired handled by rego.ts; rego internal archive expired route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:4059
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/internal/archive-expired" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/internal/archive-expired", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

753. POST /api/rego/payment-link-reference

• Purpose: POST /api/rego/payment-link-reference handled by rego.ts; rego payment link reference route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1283
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/payment-link-reference" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/payment-link-reference", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

754. PUT /api/rego/prefills

• Purpose: PUT /api/rego/prefills handled by rego.ts; rego prefills route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2051
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/prefills" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

755. DELETE /api/rego/prefills/:eventId

• Purpose: DELETE /api/rego/prefills/:eventId handled by rego.ts; rego prefills eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2270
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/prefills/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills/:eventId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

756. GET /api/rego/prefills/:eventId

• Purpose: GET /api/rego/prefills/:eventId handled by rego.ts; rego prefills eventId route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2015
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: eventId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/prefills/:eventId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/prefills/:eventId", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

757. GET /api/rego/profile

• Purpose: GET /api/rego/profile handled by regoProfile.ts; rego profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:173
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

758. PUT /api/rego/profile

• Purpose: PUT /api/rego/profile handled by regoProfile.ts; rego profile route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:273
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/rego/profile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

759. PATCH /api/rego/profile/email-preferences

• Purpose: PATCH /api/rego/profile/email-preferences handled by regoProfile.ts; rego profile email preferences route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:385
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May send or prepare outbound communications.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/profile/email-preferences" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/email-preferences", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

760. GET /api/rego/profile/import-dashboard

• Purpose: GET /api/rego/profile/import-dashboard handled by regoProfile.ts; rego profile import dashboard route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:199
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/profile/import-dashboard" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/import-dashboard", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

761. POST /api/rego/profile/phone/validate

• Purpose: POST /api/rego/profile/phone/validate handled by regoProfile.ts; rego profile phone validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:263
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/profile/phone/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/phone/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

762. GET /api/rego/profile/photo

• Purpose: GET /api/rego/profile/photo handled by regoProfile.ts; rego profile photo route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:486
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/profile/photo" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/photo", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

763. PATCH /api/rego/profile/photo

• Purpose: PATCH /api/rego/profile/photo handled by regoProfile.ts; rego profile photo route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:505
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/profile/photo" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/photo", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

764. PATCH /api/rego/profile/username

• Purpose: PATCH /api/rego/profile/username handled by regoProfile.ts; rego profile username route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:451
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/profile/username" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/profile/username", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

765. POST /api/rego/quote

• Purpose: POST /api/rego/quote handled by rego.ts; rego quote route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:1358
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/quote" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/quote", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

766. POST /api/rego/regos

• Purpose: POST /api/rego/regos handled by rego.ts; rego regos route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2620
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/regos" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

767. GET /api/rego/regos/:ref

• Purpose: GET /api/rego/regos/:ref handled by rego.ts; rego regos ref route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2361
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

768. GET /api/rego/regos/:ref/wallet

• Purpose: GET /api/rego/regos/:ref/wallet handled by rego.ts; rego regos ref wallet route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2550
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: ref
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Google Wallet pass state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/:ref/wallet" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/:ref/wallet", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

769. GET /api/rego/regos/me

• Purpose: GET /api/rego/regos/me handled by rego.ts; rego regos me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:2296
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/regos/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/regos/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

770. GET /api/rego/username/check

• Purpose: GET /api/rego/username/check handled by regoProfile.ts; rego username check route contract must be verified against source before integration.
• Source: partners-api/src/routes/regoProfile.ts:433
• Mounted prefix: /api
• Route module: regoProfile.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/username/check" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/username/check", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

771. POST /api/rego/waitlist

• Purpose: POST /api/rego/waitlist handled by rego.ts; rego waitlist route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:3969
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego auth optional for new attendee flow.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

772. POST /api/rego/waitlist/:entryId/accept

• Purpose: POST /api/rego/waitlist/:entryId/accept handled by waitlist.ts; rego waitlist entryId accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:553
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist/:entryId/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/:entryId/accept", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

773. POST /api/rego/waitlist/:entryId/decline

• Purpose: POST /api/rego/waitlist/:entryId/decline handled by waitlist.ts; rego waitlist entryId decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:470
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: entryId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/waitlist/:entryId/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/:entryId/decline", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

774. GET /api/rego/waitlist/me

• Purpose: GET /api/rego/waitlist/me handled by rego.ts; rego waitlist me route contract must be verified against source before integration.
• Source: partners-api/src/routes/rego.ts:3927
• Mounted prefix: /api
• Route module: rego.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/waitlist/me" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/me", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

775. GET /api/rego/waitlist/pending-offer

• Purpose: GET /api/rego/waitlist/pending-offer handled by waitlist.ts; rego waitlist pending offer route contract must be verified against source before integration.
• Source: partners-api/src/routes/waitlist.ts:413
• Mounted prefix: /api
• Route module: waitlist.ts
• Router variable: api
• Stability: rego internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/waitlist/pending-offer" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/waitlist/pending-offer", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/registration-and-attendees/

776. GET /api/events/:id/social/bot-settings

• Purpose: GET /api/events/:id/social/bot-settings handled by socialLinking.ts; events id social bot settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1862
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

777. PATCH /api/events/:id/social/bot-settings

• Purpose: PATCH /api/events/:id/social/bot-settings handled by socialLinking.ts; events id social bot settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1903
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

778. GET /api/events/:id/social/discord/guilds

• Purpose: GET /api/events/:id/social/discord/guilds handled by socialLinking.ts; events id social discord guilds route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1744
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

779. GET /api/events/:id/social/discord/guilds/:guildId/roles

• Purpose: GET /api/events/:id/social/discord/guilds/:guildId/roles handled by socialLinking.ts; events id social discord guilds guildId roles route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1765
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds/:guildId/roles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds/:guildId/roles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

780. GET /api/events/:id/social/discord/link/start

• Purpose: GET /api/events/:id/social/discord/link/start handled by socialLinking.ts; events id social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1668
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

781. GET /api/events/:id/social/telegram/chats

• Purpose: GET /api/events/:id/social/telegram/chats handled by socialLinking.ts; events id social telegram chats route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1801
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/chats" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/chats", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

782. POST /api/events/:id/social/telegram/link/complete

• Purpose: POST /api/events/:id/social/telegram/link/complete handled by socialLinking.ts; events id social telegram link complete route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1929
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/social/telegram/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

783. GET /api/events/:id/social/telegram/link/start

• Purpose: GET /api/events/:id/social/telegram/link/start handled by socialLinking.ts; events id social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1698
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

784. GET /api/events/:id/zep/app-bundle

• Purpose: GET /api/events/:id/zep/app-bundle handled by zep.ts; events id zep app bundle route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:484
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/app-bundle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/app-bundle", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

785. GET /api/events/:id/zep/config

• Purpose: GET /api/events/:id/zep/config handled by zep.ts; events id zep config route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:422
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

786. PUT /api/events/:id/zep/config

• Purpose: PUT /api/events/:id/zep/config handled by zep.ts; events id zep config route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:501
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

787. POST /api/internal/social-entitlements/reconcile

• Purpose: POST /api/internal/social-entitlements/reconcile handled by socialLinking.ts; internal social entitlements reconcile route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:2288
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: internalApi
• Stability: partner dashboard internal
• Authentication: Internal cron secret required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/internal/social-entitlements/reconcile" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/internal/social-entitlements/reconcile", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

788. GET /api/manage/:id/social/bot-settings

• Purpose: GET /api/manage/:id/social/bot-settings is the Event Management compatibility alias for /api/events/:id/social/bot-settings.
• Source: partners-api/src/routes/socialLinking.ts:1862
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

789. PATCH /api/manage/:id/social/bot-settings

• Purpose: PATCH /api/manage/:id/social/bot-settings is the Event Management compatibility alias for /api/events/:id/social/bot-settings.
• Source: partners-api/src/routes/socialLinking.ts:1903
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/events/:id/social/bot-settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/bot-settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

790. GET /api/manage/:id/social/discord/guilds

• Purpose: GET /api/manage/:id/social/discord/guilds is the Event Management compatibility alias for /api/events/:id/social/discord/guilds.
• Source: partners-api/src/routes/socialLinking.ts:1744
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

791. GET /api/manage/:id/social/discord/guilds/:guildId/roles

• Purpose: GET /api/manage/:id/social/discord/guilds/:guildId/roles is the Event Management compatibility alias for /api/events/:id/social/discord/guilds/:guildId/roles.
• Source: partners-api/src/routes/socialLinking.ts:1765
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id, guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/guilds/:guildId/roles" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/guilds/:guildId/roles", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

792. GET /api/manage/:id/social/discord/link/start

• Purpose: GET /api/manage/:id/social/discord/link/start is the Event Management compatibility alias for /api/events/:id/social/discord/link/start.
• Source: partners-api/src/routes/socialLinking.ts:1668
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

793. GET /api/manage/:id/social/telegram/chats

• Purpose: GET /api/manage/:id/social/telegram/chats is the Event Management compatibility alias for /api/events/:id/social/telegram/chats.
• Source: partners-api/src/routes/socialLinking.ts:1801
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/chats" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/chats", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

794. POST /api/manage/:id/social/telegram/link/complete

• Purpose: POST /api/manage/:id/social/telegram/link/complete is the Event Management compatibility alias for /api/events/:id/social/telegram/link/complete.
• Source: partners-api/src/routes/socialLinking.ts:1929
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/events/:id/social/telegram/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

795. GET /api/manage/:id/social/telegram/link/start

• Purpose: GET /api/manage/:id/social/telegram/link/start is the Event Management compatibility alias for /api/events/:id/social/telegram/link/start.
• Source: partners-api/src/routes/socialLinking.ts:1698
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

796. GET /api/manage/:id/zep/app-bundle

• Purpose: GET /api/manage/:id/zep/app-bundle is the Event Management compatibility alias for /api/events/:id/zep/app-bundle.
• Source: partners-api/src/routes/zep.ts:484
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/app-bundle" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/app-bundle", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

797. GET /api/manage/:id/zep/config

• Purpose: GET /api/manage/:id/zep/config is the Event Management compatibility alias for /api/events/:id/zep/config.
• Source: partners-api/src/routes/zep.ts:422
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

798. PUT /api/manage/:id/zep/config

• Purpose: PUT /api/manage/:id/zep/config is the Event Management compatibility alias for /api/events/:id/zep/config.
• Source: partners-api/src/routes/zep.ts:501
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: partnerApi
• Stability: partner dashboard internal; alias
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PUT "https://api.furries.ph/api/events/:id/zep/config" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/events/:id/zep/config", apiBase), { method: "PUT", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

799. DELETE /api/org/social/discord/guilds/:guildId

• Purpose: DELETE /api/org/social/discord/guilds/:guildId handled by socialLinking.ts; org social discord guilds guildId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1822
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: guildId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/org/social/discord/guilds/:guildId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/guilds/:guildId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

800. GET /api/org/social/discord/link/start

• Purpose: GET /api/org/social/discord/link/start handled by socialLinking.ts; org social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1492
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

801. POST /api/org/social/discord/unlink

• Purpose: POST /api/org/social/discord/unlink handled by socialLinking.ts; org social discord unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1522
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/discord/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/discord/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

802. GET /api/org/social/settings

• Purpose: GET /api/org/social/settings handled by socialLinking.ts; org social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1452
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

803. POST /api/org/social/telegram/chat/link/complete

• Purpose: POST /api/org/social/telegram/chat/link/complete handled by socialLinking.ts; org social telegram chat link complete route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1642
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/telegram/chat/link/complete" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chat/link/complete", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

804. GET /api/org/social/telegram/chat/link/start

• Purpose: GET /api/org/social/telegram/chat/link/start handled by socialLinking.ts; org social telegram chat link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1600
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/telegram/chat/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chat/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

805. DELETE /api/org/social/telegram/chats/:chatId

• Purpose: DELETE /api/org/social/telegram/chats/:chatId handled by socialLinking.ts; org social telegram chats chatId route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1842
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: chatId
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/org/social/telegram/chats/:chatId" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/chats/:chatId", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

806. GET /api/org/social/telegram/link/start

• Purpose: GET /api/org/social/telegram/link/start handled by socialLinking.ts; org social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1544
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/org/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

807. POST /api/org/social/telegram/unlink

• Purpose: POST /api/org/social/telegram/unlink handled by socialLinking.ts; org social telegram unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1578
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: partnerApi
• Stability: partner dashboard internal
• Authentication: Partner dashboard session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/org/social/telegram/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/org/social/telegram/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

808. GET /api/rego/friends

• Purpose: GET /api/rego/friends handled by social.ts; rego friends route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:183
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

809. DELETE /api/rego/friends/:id

• Purpose: DELETE /api/rego/friends/:id handled by social.ts; rego friends id route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:559
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X DELETE "https://api.furries.ph/api/rego/friends/:id" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id", apiBase), { method: "DELETE", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

810. PATCH /api/rego/friends/:id/accept

• Purpose: PATCH /api/rego/friends/:id/accept handled by social.ts; rego friends id accept route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:418
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/friends/:id/accept" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/accept", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

811. PATCH /api/rego/friends/:id/decline

• Purpose: PATCH /api/rego/friends/:id/decline handled by social.ts; rego friends id decline route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:488
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: id
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/friends/:id/decline" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/:id/decline", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

812. GET /api/rego/friends/events

• Purpose: GET /api/rego/friends/events handled by social.ts; rego friends events route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:673
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/events" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/events", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

813. POST /api/rego/friends/request

• Purpose: POST /api/rego/friends/request handled by social.ts; rego friends request route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:301
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/friends/request" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/request", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

814. GET /api/rego/friends/requests

• Purpose: GET /api/rego/friends/requests handled by social.ts; rego friends requests route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:241
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/requests" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/requests", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

815. GET /api/rego/friends/sent

• Purpose: GET /api/rego/friends/sent handled by social.ts; rego friends sent route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:271
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/friends/sent" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/friends/sent", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

816. GET /api/rego/social/discord/link/start

• Purpose: GET /api/rego/social/discord/link/start handled by socialLinking.ts; rego social discord link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1346
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/discord/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/discord/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

817. POST /api/rego/social/discord/unlink

• Purpose: POST /api/rego/social/discord/unlink handled by socialLinking.ts; rego social discord unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1402
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/social/discord/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/discord/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

818. GET /api/rego/social/settings

• Purpose: GET /api/rego/social/settings handled by social.ts; rego social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:58
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/settings", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

819. PATCH /api/rego/social/settings

• Purpose: PATCH /api/rego/social/settings handled by social.ts; rego social settings route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:81
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Discord integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X PATCH "https://api.furries.ph/api/rego/social/settings" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/settings", apiBase), { method: "PATCH", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

820. GET /api/rego/social/telegram/link/start

• Purpose: GET /api/rego/social/telegram/link/start handled by socialLinking.ts; rego social telegram link start route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1372
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/social/telegram/link/start" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/telegram/link/start", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

821. POST /api/rego/social/telegram/unlink

• Purpose: POST /api/rego/social/telegram/unlink handled by socialLinking.ts; rego social telegram unlink route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1427
• Mounted prefix: /api
• Route module: socialLinking.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/social/telegram/unlink" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/social/telegram/unlink", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

822. GET /api/rego/users/search

• Purpose: GET /api/rego/users/search handled by social.ts; rego users search route contract must be verified against source before integration.
• Source: partners-api/src/routes/social.ts:129
• Mounted prefix: /api
• Route module: social.ts
• Router variable: api
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/users/search" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/users/search", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

823. POST /api/rego/zep/launch

• Purpose: POST /api/rego/zep/launch handled by zep.ts; rego zep launch route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:695
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/rego/zep/launch" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/zep/launch", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

824. GET /api/rego/zep/status

• Purpose: GET /api/rego/zep/status handled by zep.ts; rego zep status route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:680
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: attendeeApi
• Stability: partner dashboard internal
• Authentication: Rego attendee session required.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Usually none unless handler reads body; verify source.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: Unknown from source scan; inspect handler before relying on side-effect behavior.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X GET "https://api.furries.ph/api/rego/zep/status" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/rego/zep/status", apiBase), { method: "GET", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

825. POST /api/zep/validate

• Purpose: POST /api/zep/validate handled by zep.ts; zep validate route contract must be verified against source before integration.
• Source: partners-api/src/routes/zep.ts:728
• Mounted prefix: /api
• Route module: zep.ts
• Router variable: publicApi
• Stability: partner dashboard internal
• Authentication: Unknown from source scan; inspect middleware and handler body before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/api/zep/validate" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/api/zep/validate", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

826. POST /hooks/telegram

• Purpose: POST /hooks/telegram handled by socialLinking.ts; hooks telegram route contract must be verified against source before integration.
• Source: partners-api/src/routes/socialLinking.ts:1059
• Mounted prefix: /hooks
• Route module: socialLinking.ts
• Router variable: telegramWebhookRoutes
• Stability: auth-or-webhook
• Authentication: Webhook/internal route; inspect signature or shared secret verification before use.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records. May touch Telegram integration state.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/hooks/telegram" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/hooks/telegram", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/social-and-integrations/

827. POST /contact

• Purpose: POST /contact handled by contact.ts; contact route contract must be verified against source before integration.
• Source: partners-api/src/routes/contact.ts:28
• Mounted prefix: /contact
• Route module: contact.ts
• Router variable: contact
• Stability: public
• Authentication: Public route with validation and outbound mail behavior.
• Required headers: Unknown from source scan; inspect handler and middleware.
• Optional headers: Authorization, Content-Type, X-Test-Control-Secret, X-Test-Run-Id, and X-Test-Rego-User-Id are allowed by Worker CORS when applicable.
• Path parameters: None detected from route path.
• Query parameters: Unknown from source scan; inspect c.req.query() and URL parsing in handler.
• Body schema: Unknown from source scan; inspect c.req.json(), parseBody(), form parsing, and validation helpers.
• Accepted content types: application/json when a body is accepted
• Pagination, filtering, sorting: Unknown from source scan; inspect query parsing and Supabase range/order/filter calls.
• Success status codes: Usually 200 JSON unless handler sets another status; verify source.
• Response shape: Unknown from source scan; inspect returned c.json(...), redirects, streams, or binary responses.
• Error status codes: Worker-level 404 returns { error: "Not found" }; uncaught errors return { error: "Internal server error" }; handler-specific errors must be inspected.
• Error shape: Usually JSON with an error field; verify handler-specific details.
• Side effects: May mutate platform records.
• Records touched: Unknown from source scan; inspect Supabase table names, storage calls, KV access, and external service helpers.
• Idempotency and retry: Unknown from source scan; developers must verify duplicate-submit and retry behavior before client retries.
• Privacy and security: Classify before use: route may expose attendee, partner, staff, event, finance-adjacent, or trust-safety data.
• curl example: curl -X POST "https://api.furries.ph/contact" -H "Content-Type: application/json"
• TypeScript example: await fetch(new URL("/contact", apiBase), { method: "POST", credentials: 'include' });
• Related docs: /platform-api/authentication/permissions-and-roles/, /platform-api/schemas/error-shapes/, /platform-api/route-reference/webhooks-and-contact/