API¶

The JSON API lives under /api and is written with huma, code first. The server publishes:

/api/openapi (OpenAPI 3.1 spec, also targetlog openapi on the command line),
/api/docs (interactive documentation).

The frontend uses openapi-fetch with types generated from the spec: after changing an operation, run make api and commit web/openapi.json and web/src/lib/api.gen.ts.

Authentication¶

Client	How
App	session cookie `targetlog_session` from `POST /api/auth/login`
Kiosk screen	`Authorization: Bearer <kiosk token>` on `/api/kiosk/*`, `?token=` on the WebSocket
Print agent	`Authorization: Bearer <agent token>` on `/api/agent/*`

Conventions¶

Tenant-scoped paths: /api/tenants/{tenantId}/…; non-members get 404, staff get 403 on admin operations.
Errors are RFC 9457 problem details (application/problem+json) with an English detail.
A change to an archived event answers 409.
WebSockets: /api/tenants/{tenantId}/events/{eventId}/live and /api/kiosk/live send {topic} messages; clients refetch what the topic covers.