API Overview

All Parlevel API routes are Next.js Route Handlers under /api. They require authentication via Supabase JWT.

Authentication

Every request must include a valid Supabase access token:

Authorization: Bearer <supabase-access-token>

To get the token client-side:

const { data: { session } } = await supabase.auth.getSession()
const token = session?.access_token

Location context

RFID endpoints are location-scoped. Pass the active location ID in a header:

x-selected-location: 42

If omitted, the first location the authenticated user has access to is used.

Response format

All endpoints return JSON with an ok boolean:

{ "ok": true, "result": { ... } }

Errors:

{ "ok": false, "error": "Description of the error" }

HTTP status codes:

• 200 — success
• 400 — bad request (missing/invalid params)
• 401 / 403 — authentication failure
• 502 — relay unreachable or returned an error
• 503 — feature disabled (e.g. ingest not enabled)
• 500 — unexpected server error

RFID API routes