GuidesAPI ReferenceMCPChangelog
Shared

Start a new campaign draft (admin, or manage_org_settings)

post/api/marketing/campaigns

Inserts an empty book_campaigns row (every column already carries its own DB default, see migration 0144) and returns its id. The client navigates to /dashboard/marketing/campaigns/{id} on success; deliberately not a page-level redirect, since a GET-rendered page performing this insert would fire on Next.js Link prefetch.

Authorization

sessionCookie
sb-qxrvgfkjyvbngipqvslu-auth-token<token>

The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.

Every request re-validates it against the Auth server (getUser()), never by decoding the cookie locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified app_metadata.company_id claim and enforced by row-level security; it is never read from request input, on any route, ever.

role (admin / staff) is deliberately not in RLS. It gates specific actions in route code, the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's own check is the enforcement.

In: cookie

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/marketing/campaigns"
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"}

List this organization's campaigns GET

History for the Campaigns hub: up to 50 most recent, newest first, with a live `reach`/`sent` count per row computed against book_campaign_recipients rather than a stored counter. Any signed-in member may read this; only manage_org_settings may create, edit or send one (see the other operations on this path and on /api/marketing/campaigns/{id}).

Autosave a campaign draft (admin, or manage_org_settings) PATCH

Accepts a PARTIAL object: only the keys present are validated and written, so one keystroke never re-sends every field. `.eq('status','draft')` is a second WHERE clause, not a separate read-then-write: a campaign that started sending between page load and this autosave firing must not have its content rewritten out from under the send in flight. 409 is deliberately ambiguous between "no such campaign for this company" and "it already left draft"; the compose page's own status banner is what actually tells the operator which one happened.