Record a gift card redemption
/api/marketing/gift-cards/{id}/redeemLoosened from admin-only to any signed-in member (2026-08-30): CloseOutDialog's own GiftCardRedeemField now calls this same route to apply a card at close-out, and CloseOutDialog's own PATCH (appointments/reservations) has no minRole, so this route's permission now matches the flow that actually takes payment, exactly as this route's own prior comment said it should once close-out wiring existed. Still reached standalone from the Gift Cards tab too. Atomically decrements balance_cents and writes an audit row via book_gift_card_redeem() (service_role only): PostgREST cannot express a balance decrement as one atomic expression, and a read-then-write from this route would race under concurrent redemptions.
Authorization
sessionCookie The dashboard's Supabase Auth session cookie, set at sign-in. Large sessions are split across
numbered chunks (…auth-token.0, .1), so treat this as a cookie family rather than one name.
Every request re-validates it against the Auth server (getUser()), never by decoding the cookie
locally: a JWT nothing has checked is not a credential. Tenancy is then read from the verified
app_metadata.company_id claim and enforced by row-level security; it is never read from request
input, on any route, ever.
role (admin / staff) is deliberately not in RLS. It gates specific actions in route code,
the operations marked admin below, so hiding a button in the UI is cosmetic only, and a route's
own check is the enforcement.
In: cookie
Path Parameters
Gift card id.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/marketing/gift-cards/string/redeem" \ -H "Content-Type: application/json" \ -d '{ "amountCents": 1 }'{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "balanceCents": 0, "status": "active"}Issue a gift card (admin, or manage_org_settings) POST
v1: desk-issued only (migration 0162). No online sale and no close-out dialog wiring yet; see that migration's own header for the full staged plan. Generates an 8-character code (src/lib/marketing/gift-cards/codes.ts), retrying up to 3 times on the rare per-company collision (book_gift_cards_company_code). Gated the same permission Campaigns' own draft-create route uses: issuing a card is a manager-level decision to put real value on the books, not a front-desk errand.
Resolve a gift card code to its id and balance GET
The lookup half of the redeem flow (2026-08-30, added alongside CloseOutDialog's GiftCardRedeemField): a staff member types a code, this resolves it to the card, and the redeem route above takes the id. Case/whitespace-insensitive. Scoped to the caller's own company: a code is unique per company, not globally (book_gift_cards_company_code, migration 0162), exactly because redemption always happens inside a company's own dashboard.