Apply, or manually correct, a customer package's sessions
/api/customer-packages/{id}/redeemCalls book_package_redeem() (migration 20260917130000), which atomically applies delta to sessions_remaining and records a book_package_redemptions ledger row in the same statement, the same shape book_gift_card_redeem() takes. delta is negative for an ordinary "use a session" (reason visit) and positive for a manual correction (reason manual_adjustment, e.g. undoing a mistaken use). Same permission bar as gift-card redemption: any signed-in staff member, no manage_services gate.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Path Parameters
Customer package id (book_customer_packages.id, not the catalog book_packages.id).
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/customer-packages/string/redeem" \ -H "Content-Type: application/json" \ -d '{ "delta": 0 }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "sessionsRemaining": 0}Sell a package to a customer POST
Snapshots name/price/sessions off the CURRENT book_packages row onto a new book_customer_packages row: v1's only sale path (BeNotely also sells from "New sale" and at close-out; both are follow-ups, see migration 20260917130000's own header). Service-role, not the RLS-scoped client: book_customer_packages has no INSERT grant for `authenticated` at all. No `manage_services` gate; selling an existing catalog item to a customer is the same everyday action a walk-in sale or a close-out payment already is.
Read the venue opening hours (admin, or manage_org_settings) GET
Venue-level opening hours (`book_company_hours`, migration 0027); "when is the business open", as distinct from a staff member's own working hours. `computeAvailableSlots` intersects the two, so a booking must fit inside both. Times come back as HH:MM, ordered by day then start time. Appointments only: a hospitality org uses `book_service_periods`, which already carries the lunch/dinner split plus turn time, last seating and covers caps. Gated to admin, or a staff login granted `manage_org_settings` (migration 0082).