Access and Core Data

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Family summary

Generic data access helpers, profile records, uploads, image proxying, SPA contracts, and guarded test-run utilities.

Personal bio formatting policy

GET /api/v2/profile/policy requires the current account’s authenticated session and returns { "allowBioNewlines": false } by default. Partners and Rego use this setting in both profile setup and profile editing. Bios remain optional and limited to 300 Unicode characters. When line breaks are disabled, the API replaces them with spaces in profile responses, staff directory responses, and newly saved bios. When enabled, bios may contain multiple lines.

Changing the policy preserves previously stored bio text. Saving an edited bio while line breaks are disabled stores its single-line form. The full profile save and PATCH /api/v2/profile/bio use the same server-owned policy; request bodies cannot override it. A policy read failure does not enable line breaks.

Modules audited

• rows.ts: 10 generated endpoint entries.
• mutations.ts: 14 generated endpoint entries.
• profile.ts: 0 generated endpoint entries.
• personProfiles.ts: 6 generated endpoint entries.
• staffProfiles.ts: 5 generated endpoint entries.
• uploadImage.ts: 2 generated endpoint entries.
• imgProxy.ts: 2 generated endpoint entries.
• spaContracts.ts: 1 generated endpoint entries.
• testRuns.ts: 18 generated endpoint entries.

Endpoint table

Method	Path	Module	Auth scan	Source
GET	/api/admin/attendees	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:475
DELETE	/api/admin/attendees/:attendeeAccountId/incomplete-profile	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:381
DELETE	/api/admin/attendees/disposable-test-identities	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:290
POST	/api/admin/attendees/disposable-test-identities	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:263
GET	/api/admin/user-profiles	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:173
POST	/api/events	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/events/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/events/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/events/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/img/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:63
POST	/api/incidents	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:579
PUT	/api/incidents/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:618
PATCH	/api/incidents/:id/actions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:684
POST	/api/incidents/:id/cross-ban-decision	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:840
POST	/api/internal/test-runs	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1764
DELETE	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3342
POST	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3314
POST	/api/internal/test-runs/:runId/cleanup	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3148
POST	/api/internal/test-runs/:runId/dashboard-session	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1801
POST	/api/internal/test-runs/:runId/rego-sessions/bulk	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1829
DELETE	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3292
POST	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3263
POST	/api/internal/test-runs/:runId/seed/event	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2469
POST	/api/internal/test-runs/:runId/seed/social-graph	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2211
POST	/api/internal/test-runs/:runId/seed/staff	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2039
GET	/api/internal/test-runs/:runId/snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3364
POST	/api/internal/test-runs/:runId/social-withdrawal-snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2386
POST	/api/internal/test-runs/:runId/state/fast-forward	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3065
POST	/api/internal/test-runs/:runId/suppress-side-effects	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3237
POST	/api/internal/test-runs/:runId/verify	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3383
POST	/api/internal/test-runs/:runId/withdraw-auth-identity	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2354
POST	/api/internal/test-runs/sweep	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3196
POST	/api/manage	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/manage/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/manage/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/manage/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/media/:bucket/images/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:64
GET	/api/partner-directory	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1187
POST	/api/pawsports/bind	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:477
GET	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:18
POST	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:77
DELETE	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:152
PUT	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:125
POST	/api/person-profiles/:id/links	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:171
DELETE	/api/person-profiles/:id/links/:reportId	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:204
GET	/api/platform-fees	rows.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rows.ts:1245
GET	/api/rego/event-regos/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:524
GET	/api/rego/event-waitlist/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:654
POST	/api/rego/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:230
PATCH	/api/regos/:id/payment-status	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:713
POST	/api/regos/:regId/email	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:885
POST	/api/regos/:regId/email-preview	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1000
GET	/api/rows	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:116
GET	/api/spa/contracts	spaContracts.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/spaContracts.ts:72
POST	/api/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:229
POST	/api/watchlist/adoptions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:775
POST	/api/watchlist/grants	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:740
POST	/api/watchlist/master-requests	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:809

Endpoint contract notes

1. Action 1 - Verify unknowns: The table is source-generated, but fields marked unknown need manual handler review.
2. Action 2 - Check source line: Use the source line as the starting point for exact request, response, and side-effect behavior.
3. Action 3 - Review consumers: Search dashboard, rego, EMS LAN, and webhook callers before changing a path or response.
4. Action 4 - Update inventory: Regenerate after any route change.