Read the venue opening hours (admin, or manage_org_settings)
/api/organization/hoursVenue-level opening hours (book_company_hours, migration 0027); "when is the business open", as distinct from a staff member's own working hours. computeAvailableSlots intersects the two, so a booking must fit inside both. Times come back as HH:MM, ordered by day then start time. Appointments only: a hospitality org uses book_service_periods, which already carries the lunch/dinner split plus turn time, last seating and covers caps. Gated to admin, or a staff login granted manage_org_settings (migration 0082).
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/organization/hours"{ "hours": [ { "dayOfWeek": 0, "startTime": "string", "endTime": "string" } ]}Apply, or manually correct, a customer package's sessions POST
Calls book_package_redeem() (migration 20260917130000), which atomically applies `delta` to sessions_remaining and records a book_package_redemptions ledger row in the same statement, the same shape book_gift_card_redeem() takes. `delta` is negative for an ordinary "use a session" (reason `visit`) and positive for a manual correction (reason `manual_adjustment`, e.g. undoing a mistaken use). Same permission bar as gift-card redemption: any signed-in staff member, no `manage_services` gate.
Replace the venue opening hours (admin, or manage_org_settings) PUT
PUT, not PATCH: the editor holds the whole week and a window has no stable identity in it, so "these are the hours" is the only honest request shape. **An empty array means NO VENUE RESTRICTION, not "closed all week"**: zero rows has to keep meaning unclamped, because that is the state every org is in until it saves hours here, and any other reading would take every existing booking page to zero availability. Delete-then-insert over PostgREST is two transactions; if the insert fails the org is left with no rows, which fails permissive (staff hours alone apply) and is reported as such. Gated to admin, or a staff login granted `manage_org_settings` (migration 0082).