Issue a gift card (admin, or manage_org_settings)
/api/marketing/gift-cardsv1: desk-issued only (migration 0162). No online sale and no close-out dialog wiring yet; see that migration's own header for the full staged plan. Generates an 8-character code (src/lib/marketing/gift-cards/codes.ts), retrying up to 3 times on the rare per-company collision (book_gift_cards_company_code). Gated the same permission Campaigns' own draft-create route uses: issuing a card is a manager-level decision to put real value on the books, not a front-desk errand.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/marketing/gift-cards" \ -H "Content-Type: application/json" \ -d '{ "amountCents": 1 }'{ "giftCard": {}}Send a test of a campaign to yourself (admin, or manage_org_settings) POST
Sends to the SIGNED-IN ADMIN'S OWN ACCOUNT EMAIL (`user.email`, never a book_customers lookup) via sendEmail() directly: not meteredSendEmail, not sendMarketingEmail, deliberately bypassing the consent gate and the usage ledger. `[TEST] ` subject prefix; no `List-Unsubscribe` header and no unsubscribe footer line, same as every transactional email. No status restriction: useful before, during or after a real send.
Record a gift card redemption POST
Loosened from admin-only to any signed-in member (2026-08-30): CloseOutDialog's own GiftCardRedeemField now calls this same route to apply a card at close-out, and CloseOutDialog's own PATCH (appointments/reservations) has no minRole, so this route's permission now matches the flow that actually takes payment, exactly as this route's own prior comment said it should once close-out wiring existed. Still reached standalone from the Gift Cards tab too. Atomically decrements `balance_cents` and writes an audit row via `book_gift_card_redeem()` (service_role only): PostgREST cannot express a balance decrement as one atomic expression, and a read-then-write from this route would race under concurrent redemptions.