Allows a logged-in user to change their password. Requires the current password and a new password, which must be at least 6 characters long. Sends a security notification email upon successful change.

No description provided.

No description provided.

Returns a masked username for a customer using a verified phone session token. The session token is consumed after use.

Resets the password for a customer using a verified phone session token. The new password must be at least 6 characters long.

Resets the password for a customer user using a valid reset token. The new password must be at least 6 characters long.

Allows customer users to request a password reset link. It sends an email with a reset token if the account exists.

Allows customer users to recover their username. It sends an email containing the username if the email is registered.

GET /api/customers/{id}/score - single customer score.

GET /api/customers/scores

Authenticates a user with a username and password. If successful and the email is verified, it establishes a user session. Otherwise, it returns an error for invalid credentials or unverified email.

Retrieves the profile information of the currently logged-in user.

Called after Stripe payment succeeds on the frontend. Updates the order's payment_status and stores the payment_intent_id.

Create a Stripe PaymentIntent for a given order total. Called from the frontend checkout when customer selects credit card.

Generates a Stripe Payment Link for an order. Can be called by staff, the voice agent, or the customer dashboard.

Accepts front and back check image uploads for an order. Requires staff authentication — check images are sensitive financial documents.

List all vendors, active by default. Can include inactive vendors with a query parameter.

Create a new vendor. Requires admin or manager staff role.

Retrieve details for a single vendor, including all associated products.

Update an existing vendor's details. Requires admin or manager staff role.

Delete a vendor and all its associated products. Requires admin staff role.

Registers a new user, checking for existing accounts by username, email, or phone. It creates a new user, hashes the password, generates an email verification token, and sends a verification email. The user must verify their email before logging in.

Handles the "Save Me Money" form submission, collecting contact and restaurant details, and an optional invoice file. It then sends an email with the submission information.

Retrieves the record for the currently logged-in user. Note: This endpoint is intended for customers to see only their own record, not all users.

Retrieves a specific user's profile by ID. Access is restricted to the currently logged-in user's own record.

Updates the profile information for a specific user. Only the logged-in user can update their own record, and only safe profile fields are allowed to be modified.

Deletes a specific user account. Only the logged-in user can delete their own account.

Place a new order for either logged-in users or guests, including delivery details and order items.

Retrieve all orders associated with the currently logged-in customer.

Retrieve a specific order by its order number. Allows guest tracking if no user is logged in, or if the order belongs to the logged-in user.

Return the items from a previous order for quick reordering by the customer.

Look up orders by phone number for guest tracking. Returns a slimmed-down list of recent orders.

Create a customer account at checkout, converting a guest to a registered user. Links an existing order if provided.

Creates a new product entry.

List all procurement products across all vendors. Can filter by category and include inactive products.

Update an existing procurement product. Requires admin or manager staff role.

Delete a procurement product. Requires admin or manager staff role.

List all products for a specific vendor. Can include inactive products with a query parameter.

Add a new product to a specified vendor. Requires admin or manager staff role.

Returns a paginated list of products, with optional filtering by category and search terms.

Returns details for a single product identified by its ID.

Serves a compressed and resized JPEG thumbnail for a product's primary image.

Returns a limited list of featured products that are in stock, ordered by most recently updated.

Returns details for a single product identified by its SKU.

List all products with optional filtering.

Get a single product by ID (integer) or SKU (string).

Full or partial update of any product fields.

Upload a product image (multipart/form-data).

Update inventory/stock status for a product.

Update pricing for a product.

Bulk update multiple products in a single request.

Retrieves a list of all product categories, ordered by name.

Adds a new product category to the system.

Serve the check front image for staff review. Requires staff auth.

Staff approves a check payment and confirms the order. Requires staff auth (JWT or session).

Serve the check back image for staff review. Requires staff auth.

Staff rejects a check payment — resets order to pending so Pay options reappear.

Retrieve a paginated list of customers with optional search, sorting, and filtering.

Retrieve details for a single customer by ID.

Update details for a single customer by ID. Allows partial updates.

Permanently delete a customer account. Associated orders are preserved but unlinked.

Return all orders linked to a customer by user_id, sorted newest-first with full item details.

Delete multiple customers at once.

Return a blank CSV template with the correct headers.

Find customers sharing the same primary phone number. Returns groups of customers with matching phones.

Download all customers as a CSV file.

Bulk-import customers from a CSV file. Deduplication by email or phone. Creates new customers or skips existing ones.

Full merge of two customer accounts. Transfers orders and allows choosing fields for the kept customer.

Search for customers by name, company, or phone for autofill purposes. Includes both registered users and guest order history.

Allows staff users to request a password reset link. It sends an email with a reset token if the account exists.

Allows staff users to recover their username. It sends an email containing the username if the email is registered.

Retrieve a paginated list of inventory items with optional search and filtering.

Update details for a specific product in the inventory, including stock levels and pricing.

Authenticate staff users and issue a JWT token for cross-domain authentication.

Log out the current staff user by clearing their session.

Retrieve the profile information of the currently authenticated staff user.

Retrieve a list of all orders, with optional filtering by status, date range, and sales rep. Sales reps only see their own orders.

Manually create a new order from the staff portal. Allows for custom order details and customer upsertion.

Delete an order. This action is restricted to admin and manager roles.

Update the delivery address details for a specific order. Returns the updated order and a list of fields that were changed.

Apply some or all of a user's store credit to reduce an order's balance. The order must be linked to a registered user.

Manually mark an order as paid. Requires admin, manager, or staff role. Handles overpayments by crediting the customer's account.

Update staff notes, assigned staff, and tracking number for an order. Automatically updates order status to 'shipped' if a tracking number is added.

Update the status of a specific order. Handles stock deduction/restoration and Stripe refunds for cancellations.

Retrieves a paginated list of all products for admin, including inactive ones, with optional filtering by category and search terms.

Adds a new product to the system. Only admins and managers can add products.

Updates an existing product's details. Only admins and managers can update products.

Deletes a product from the system. Only admins and managers can delete products.

Upload or replace the display image for a product. Stores the image as a base64 data URL in the database so it persists across container restarts and redeploys (no filesystem dependency).

Remove the image from a product.

Retrieves all gallery images for a specific product.

Uploads an additional image to a product's gallery. Stores the image as a base64 data URL.

Removes a specific image from a product's gallery.

Sets a gallery image as the primary display image for a product.

Updates the sort order for all images in a product's gallery.

Saves multiple product edits in a single request. Returns a summary of saved and errored products.

Pre-upload an image before the product record exists. Returns a base64 data URL that the caller includes in the create-product payload.

Returns the profile information of the currently logged-in staff member.

Allows a logged-in staff member to change their own password.

Allows a logged-in staff member to update their own email address.

Retrieves monthly profit dashboard aggregates including sales, delivery fees, cost of goods, shipping costs, and gross profit for a specified period. Requires staff with admin or manager roles.

Resets the password for a staff user using a valid reset token. The new password must be at least 6 characters long.

Perform a synchronous SMTP connection test to debug configuration issues. Returns exact error messages.

Retrieve dashboard statistics for the staff portal, including order counts and total revenue. Supports various date ranges.

List all subscriptions with optional filters.

Enroll a customer in a subscription.

Get a single subscription with full renewal history and customer order history.

Update interval, quantity, discount, notes, next_renewal_date, and delivery information for a subscription.

Cancel a subscription.

Pause a subscription.

Manually trigger a renewal for a subscription (charge + create order).

Resume a paused subscription.

Internal cron endpoint to process all due renewals.

Create a Stripe SetupIntent so the frontend can collect and save a card or ACH payment method for a customer.

Analyze product order history and suggest a renewal interval.

Send a test email to verify SMTP configuration. Reports SMTP configuration status.

Lists all staff users in the system.

Creates a new staff user with the provided details.

Returns a paginated list of website-registered user accounts. This includes users who registered via email verification or OAuth, excluding imported contacts who never self-registered.

Updates an existing staff user's details by ID.

Deletes a staff user by ID. An admin cannot delete their own account.

Return the user's current credit balance and full transaction history.

Manually issue, adjust, or deduct store credit for a user. Amount can be negative to deduct credit.

Returns all products grouped by category, optimized for the sales catalog view with slim product details.

Returns customers with phone numbers, sorted by last order date (oldest first).

Return calling list entries with pagination (prospects + registered customers).

Add a single prospect to the calling list.

Update a calling list entry.

Update a calling list entry.

Delete a calling list entry.

One-time backfill (safe to re-run).

Assign a list of entry IDs to a specific staff user (or unassign if assignee_id is null).

Batch-update last_called for a list of entry IDs in a single request.

Return distinct product SKUs and names ever purchased, for the call list filter.

Admin/manager endpoint: recalculate and persist decayed scores for all non-DNC entries.

Trigger a score event for a calling list entry matched by phone or email.

Return counts for each segment tab + todays KPI stats for the logged-in rep.

Return all active sales_rep and admin staff for the assign dropdown.

Bulk-upload prospects from CSV.

Toggle commission_paid on a single order.

Mark multiple orders commission as paid or unpaid at once.

Return the ACH info on file for a customer (masked account number).

Save or update ACH bank info for a customer.

Returns full customer profile with order stats and recent order history.

Update a customer's profile fields.

Returns profile and order history for a guest customer looked up by phone number.

Full past-sales history for the logged-in rep (or all reps for admin/manager).

Poll the status of an async import job.

Return a sample CSV template for the import feature.

Bulk-import historical orders from a CSV upload (async background job).

Returns the logged-in reps attributed orders and summary stats.

Allow a sales rep to cancel their own order if it is still pending or confirmed.

Returns a full performance breakdown for all sales reps (or a single rep).

Place an order on behalf of a customer, attributed to the logged-in sales rep.

Returns the current call script.

Admin/manager: update the call script.

Assign or reassign an order to a sales representative. Restricted to admin and manager roles.

Returns a list of staff users with the 'sales_rep' role.

Retrieves a list of all existing box recommendation rules.

Creates a new box recommendation rule.

Updates an existing box recommendation rule by its ID.

Deletes a box recommendation rule by its ID.

Suggests box recommendations for products in a given order.

Searches for products based on a query string for use in box recommendations.

Triggers a Discord notification summarizing all orders that still need to be shipped. Protected by an internal secret header.

Handles staff login, authenticating users and returning a JWT token and staff details upon successful login.

Logs out the current staff user by clearing their session.

Returns the details of the currently authenticated staff user.

Returns orders that need warehouse action, with filtering, searching, and sorting capabilities.

Returns a single order's details for shipping based on its order number.

Marks an order as confirmed, indicating it has been picked and is ready to ship.

Marks an order as delivered.

Purchases a shipping label for an order using EasyPost, saves label details, and updates the order.

Returns all EasyPost labels purchased for a given order.

Hard-deletes a label record without an EasyPost refund (intended for admin use).

Voids/refunds an EasyPost shipping label, deletes the label record, and removes its tracking number from the order.

Returns packing slip data for a specific order, excluding pricing information.

Marks an order as shipped, optionally recording tracking number and carrier, and sends an SMS notification.

Fetches live tracking status for an order from EasyPost, falling back to direct carrier tracking if necessary.

Provides quick counts for the dashboard header, including shipped today, in transit, and delivered in the last 7 days.

Retrieves a list of all invoices, optionally filtered by status. Requires staff authentication.