API Reference
Complete reference for all custom Express.js API endpoints including children, calendar, activities, sessions, search, and vendor signup.
All endpoints are prefixed with /api. Authentication is via Sharetribe session cookie unless noted otherwise.
| Endpoint | Method | Body | Description |
|---|
/api/children/create | POST | { childName, birthYear } | Create child user + CalDAV calendar |
/api/children | GET | — | List parent's children |
/api/children/update | POST | { childId, ...fields } | Update child profile |
/api/children/delete | POST | { childId } | Delete child |
/api/children/upload-avatar | POST | multipart/form-data | Upload child avatar |
/api/children/remove-avatar | POST | { childId } | Remove child avatar |
/api/children/share | POST | { childId, email } | Invite another parent |
/api/children/invitations | GET | — | List pending invitations |
/api/children/invitations/accept | POST | { invitationId } | Accept invitation |
/api/children/invitations/decline | POST | { invitationId } | Decline invitation |
| Endpoint | Method | Body | Description |
|---|
/api/children/interests | GET | ?childId= | Get child's category interests |
/api/children/interests | POST | { childId, categories: string[] } | Set child's category interests (replaces all) |
/api/children/like-activity | POST | { childId, activityId } | Toggle like on an activity |
/api/children/get-likes | GET | ?childId= | Get child's liked activities |
/api/children/connections | GET | ?childId= | Get child's connections |
/api/children/connections | POST | { childId, connectedChildId, relationship } | Add bidirectional connection |
/api/children/connections | DELETE | { childId, connectedChildId } | Remove bidirectional connection |
Relationship types: twin (score 10), sibling (9), close-friend (8), friend (6), classmate (4).
All calendar endpoints verify ownership (calendar must belong to one of the user's children).
| Endpoint | Method | Body / Params | Description |
|---|
/api/calendar/create | POST | { childId } | Create CalDAV calendar for a child |
/api/calendar/list | GET | — | List all user's calendars |
/api/calendar/events/:calendarId | GET | calendarId (base64url) | Fetch events |
/api/calendar/events | POST | { calendarId, summary, dtstart, dtend, rrule? } | Create event |
/api/calendar/events/update | POST | { calendarId, eventUrl, ...fields } | Update event |
/api/calendar/events/delete | POST | { calendarId, eventUrl } | Delete event |
| Endpoint | Method | Body / Params | Description |
|---|
/api/activities | GET | — | List vendor's activities (auth: vendor) |
/api/activities/:id | GET | id (UUID) | Get single activity with sessions |
/api/activities/create | POST | { title, category, description?, ageGroupMin?, ageGroupMax?, locationAddress?, locationLat?, locationLng?, imageUrls? } | Create activity draft |
/api/activities/update | POST | { id, ...fields } | Update activity |
/api/activities/delete | POST | { id } | Delete activity + cascade sessions |
| Endpoint | Method | Body / Params | Description |
|---|
/api/sessions | GET | ?activityId= | List sessions for an activity |
/api/sessions/create | POST | { activityId, label, startDate, endDate, daysOfWeek, startTime, endTime, totalSeats, priceSubUnits, currency? } | Create session draft |
/api/sessions/update | POST | { id, ...fields } | Update session |
/api/sessions/delete | POST | { id } | Delete session + Sharetribe listing + CalDAV calendar |
/api/sessions/publish | POST | { id } | Publish: create Sharetribe listing + CalDAV calendar + Meilisearch index |
| Endpoint | Method | Body / Params | Description |
|---|
/api/search/sessions | GET | ?q=&category=&ageMin=&ageMax=&... | Search proxy to Meilisearch sessions index |
/api/search/sync | POST | { activityId? } | Manually trigger Meilisearch sync for one or all activities |
| Endpoint | Method | Body | Description |
|---|
/api/vendor-signup | POST | { orgName, contactName, email, phone?, programTypes, website?, referralSource?, notes? } | Public — no auth. Store vendor interest form submission |
Required fields: orgName, contactName, email, programTypes (non-empty array).
| File | Purpose |
|---|
server/api-util/childOwnership.js | Bidirectional parent-child ownership verification + calendar ownership |
server/api-util/crypto.js | AES-256-GCM encryption for child credentials |
server/api-util/davisClient.js | tsdav client factory, ICS parsing/building, calendar creation, vendor provisioning |
server/api-util/integrationSdk.js | Sharetribe Integration SDK singleton |
server/api-util/supabaseClient.js | Supabase client with requireSupabase() factory |
server/api-util/meilisearchClient.js | Meilisearch client with index initialization |