List guests waiting for a table
/api/waitlistThe unified Waitlist (migration 0232): entries with status open or notified, for today onward, soonest first. The three terminal statuses are deliberately absent; they are history, and this is a list a member acts on during service.
notified rows are included on purpose rather than filtered out. A member needs to see who has already been offered something, or the second table to come free that evening goes to the same guest.
source tells online (a guest joined THEMSELVES on the booking widget, for a future date that was full) from staff (a host added them at the door, right now). email is nullable since 0232: a staff entry commonly has none.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Response Body
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/waitlist"{ "entries": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "requestedDate": "2019-08-24", "requestedFrom": "string", "requestedTo": "string", "partySize": 0, "name": "string", "email": "string", "phone": "string", "notes": "string", "status": "open", "notifiedAt": "2019-08-24T14:15:22Z", "source": "online", "quotedMinutes": 0, "createdAt": "2019-08-24T14:15:22Z" } ]}Remove a level photo DELETE
Deletes the stored object and nulls `image_url`. Storage removal is best-effort and its failure does not fail the request.
Add a party waiting now at the door POST
The `source: 'staff'` half of the unified Waitlist (migration 0232): a host taking a name and a number at the door, the retired walk-in queue's own job folded into this one table. Any member, not admin-only: taking a name at the door is the job of whoever is on the door. **A phone number is REQUIRED**, unlike a `source: 'online'` entry where an email carries the offer. The entire value here is the guest being somewhere else when the table frees, so an entry that cannot be texted is a person standing at the host stand, which is what this removes. The number is NOT required to be E.164: `toE164` resolves whatever the host typed against the company's own country and timezone at send time, so "0412 345 678" works. `requestedDate` is always the venue's own local today: there is no date picker at the door, only "now" (`book_waitlist_entries_staff_shape`). There is deliberately **no public route** onto this half. A guest joins by standing in front of a host who reads the room and quotes a wait; a public one would let anyone put any number in any venue's queue from anywhere, and the venue would then text them.