Replace the venue opening hours (admin, or manage_org_settings)
/api/organization/hoursPUT, not PATCH: the editor holds the whole week and a window has no stable identity in it, so "these are the hours" is the only honest request shape. An empty array means NO VENUE RESTRICTION, not "closed all week": zero rows has to keep meaning unclamped, because that is the state every org is in until it saves hours here, and any other reading would take every existing booking page to zero availability. Delete-then-insert over PostgREST is two transactions; if the insert fails the org is left with no rows, which fails permissive (staff hours alone apply) and is reported as such. Gated to admin, or a staff login granted manage_org_settings (migration 0082).
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
curl -X PUT "https://example.com/api/organization/hours" \ -H "Content-Type: application/json" \ -d '{ "hours": [ { "dayOfWeek": 0, "startTime": "string", "endTime": "string" } ] }'{ "ok": true, "hours": [ { "dayOfWeek": 0, "startTime": "string", "endTime": "string" } ]}Read the venue opening hours (admin, or manage_org_settings) GET
Venue-level opening hours (`book_company_hours`, migration 0027); "when is the business open", as distinct from a staff member's own working hours. `computeAvailableSlots` intersects the two, so a booking must fit inside both. Times come back as HH:MM, ordered by day then start time. Appointments only: a hospitality org uses `book_service_periods`, which already carries the lunch/dinner split plus turn time, last seating and covers caps. Gated to admin, or a staff login granted `manage_org_settings` (migration 0082).
Save a page's draft content (admin, or manage_org_settings) PATCH
Writes `draft_content` ONLY; the live site (`published_content`) never moves until POST .../publish. `book_site_pages` (migration 0112), upserted rather than updated because a company that has never had this page edited before has no row yet. Gated the same way /api/organization/hours gates general org settings: admin, or a staff member holding `manage_org_settings` (0082). What a page SAYS is business-profile-shaped work, not a daily-operations action every staff login should get by default.