Access and Core Data

End-to-end developer runbook

1. Step 1 - Confirm the API area: Identify the product area, route module, endpoint path, and consumer before writing or calling code.
2. Step 2 - Read the endpoint contract: Check method, auth, parameters, response, errors, side effects, and related docs.
3. Step 3 - Prepare authentication and input: Use the right session, bearer token, webhook secret, or internal header. Validate body and query data before sending it.
4. Step 4 - Make the request: Call the endpoint from the correct origin and environment. Keep credentials and secrets out of logs.
5. Step 5 - Verify response, side effects, and records: Confirm status code, response shape, database records, external side effects, and audit evidence.
6. Step 6 - Add tests, docs, and handoff notes: Update route inventory, consumer notes, and certification checks before depending on the change.

Family summary

Generic data access helpers, profile records, uploads, image proxying, SPA contracts, and guarded test-run utilities.

Modules audited

• rows.ts: 10 generated endpoint entries.
• mutations.ts: 14 generated endpoint entries.
• profile.ts: 4 generated endpoint entries.
• personProfiles.ts: 6 generated endpoint entries.
• staffProfiles.ts: 2 generated endpoint entries.
• uploadImage.ts: 2 generated endpoint entries.
• imgProxy.ts: 1 generated endpoint entries.
• spaContracts.ts: 1 generated endpoint entries.
• testRuns.ts: 16 generated endpoint entries.

Endpoint table

Method	Path	Module	Auth scan	Source
GET	/api/admin/attendees	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:116
GET	/api/admin/user-profiles	staffProfiles.ts	Partner dashboard session required.	partners-api/src/routes/staffProfiles.ts:27
POST	/api/events	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/events/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/events/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/events/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/img/:filename	imgProxy.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/imgProxy.ts:19
POST	/api/incidents	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:580
PUT	/api/incidents/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:619
PATCH	/api/incidents/:id/actions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:685
POST	/api/incidents/:id/cross-ban-decision	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:841
POST	/api/internal/test-runs	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1597
DELETE	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3025
POST	/api/internal/test-runs/:runId/assets	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2997
POST	/api/internal/test-runs/:runId/cleanup	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2831
POST	/api/internal/test-runs/:runId/dashboard-session	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1634
POST	/api/internal/test-runs/:runId/rego-sessions/bulk	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1662
DELETE	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2975
POST	/api/internal/test-runs/:runId/roots	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2946
POST	/api/internal/test-runs/:runId/seed/event	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2183
POST	/api/internal/test-runs/:runId/seed/social-graph	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2040
POST	/api/internal/test-runs/:runId/seed/staff	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:1868
GET	/api/internal/test-runs/:runId/snapshot	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3047
POST	/api/internal/test-runs/:runId/state/fast-forward	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2748
POST	/api/internal/test-runs/:runId/suppress-side-effects	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2920
POST	/api/internal/test-runs/:runId/verify	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:3066
POST	/api/internal/test-runs/sweep	testRuns.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/testRuns.ts:2879
POST	/api/manage	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:159
GET	/api/manage/:id	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:399
PUT	/api/manage/:id	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:245
GET	/api/manage/check-rego-ref-prefix	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:204
GET	/api/partner-directory	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:1184
POST	/api/pawsports/bind	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:478
GET	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:18
POST	/api/person-profiles	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:77
DELETE	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:152
PUT	/api/person-profiles/:id	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:125
POST	/api/person-profiles/:id/links	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:171
DELETE	/api/person-profiles/:id/links/:reportId	personProfiles.ts	Partner dashboard session required.	partners-api/src/routes/personProfiles.ts:204
GET	/api/platform-fees	rows.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/rows.ts:1242
GET	/api/profile	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:47
PUT	/api/profile	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:177
GET	/api/profile/photo	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:92
PATCH	/api/profile/photo	profile.ts	Partner dashboard session required.	partners-api/src/routes/profile.ts:110
GET	/api/rego/event-regos/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:521
GET	/api/rego/event-waitlist/:eventId	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:651
POST	/api/rego/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:225
PATCH	/api/regos/:id/payment-status	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:710
POST	/api/regos/:regId/email	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:882
POST	/api/regos/:regId/email-preview	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:997
GET	/api/rows	rows.ts	Partner dashboard session required.	partners-api/src/routes/rows.ts:116
GET	/api/spa/contracts	spaContracts.ts	Unknown from source scan; inspect middleware and handler body before use.	partners-api/src/routes/spaContracts.ts:72
POST	/api/upload-image	uploadImage.ts	Rego auth optional for new attendee flow.	partners-api/src/routes/uploadImage.ts:224
POST	/api/watchlist/adoptions	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:776
POST	/api/watchlist/grants	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:741
POST	/api/watchlist/master-requests	mutations.ts	Partner dashboard session required.	partners-api/src/routes/mutations.ts:810

Endpoint contract notes

1. Action 1 - Verify unknowns: The table is source-generated, but fields marked unknown need manual handler review.
2. Action 2 - Check source line: Use the source line as the starting point for exact request, response, and side-effect behavior.
3. Action 3 - Review consumers: Search dashboard, rego, EMS LAN, and webhook callers before changing a path or response.
4. Action 4 - Update inventory: Regenerate after any route change.